longbridge-industry-overview
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the 'longbridge' CLI tool to fetch industry constituents, valuation data, and news. These commands are vendor-provided resources and align with the skill's stated purpose of financial research.
- [EXTERNAL_DOWNLOADS]: The skill retrieves external data such as news articles and index constituents via the vendor's CLI. This is a standard requirement for the tool's functionality and does not involve downloading or executing unverified scripts.
- [SAFE]: No malicious patterns, such as prompt injection, obfuscation, or persistence mechanisms, were detected. The skill is prompt-only and restricts its operations to the vendor's own infrastructure.
- [SAFE]: Indirect Prompt Injection Surface Evaluation: 1. Ingestion points: News content fetched via the 'longbridge news' command in SKILL.md. 2. Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore instructions embedded in news text. 3. Capability inventory: Commands are limited to specific subcommands of the 'longbridge' CLI tool. 4. Sanitization: No explicit content filtering or validation is specified for the retrieved news data.
Audit Metadata