tax-loss-harvest-scanner

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFENO_CODE
Full Analysis
  • [SAFE]: No malicious patterns such as prompt injection, obfuscation, or persistence mechanisms were detected in the instructions.
  • [NO_CODE]: The skill consists entirely of markdown-based instructions and logic definitions. No executable scripts, shell commands, or external package dependencies (Python or Node.js) are included.
  • [DATA_EXFILTRATION]: While the skill is designed to process sensitive financial data (holdings and transaction history across all household accounts), it lacks any tools or commands for network access, file system writes, or other exfiltration vectors. The data processing remains local to the agent session.
  • [PROMPT_INJECTION]: The skill contains no instructions designed to override agent behavior, bypass safety filters, or extract system prompts. Analysis of the indirect prompt injection surface (Category 8):
  • Ingestion points: The skill ingests untrusted financial data via taxable_holdings, all_account_transactions_60d, and planned_buys_30d as defined in SKILL.md.
  • Boundary markers: No explicit boundary markers or delimiters for user-provided data are defined in the workflow.
  • Capability inventory: None. The skill does not have access to subprocesses, file-writing tools, or network operations.
  • Sanitization: No explicit sanitization of input data is described in the workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 09:16 AM
Security Audit — agent-trust-hub — tax-loss-harvest-scanner