calculadora-cdi
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches financial data from the Banco Central do Brasil API and the melhorcambio.com website to obtain current CDI rates. These are legitimate financial data sources and are documented neutrally.
- [COMMAND_EXECUTION]: The skill invokes a local Python utility (scripts/cdi.py) via shell commands to process the investment calculations.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill takes untrusted user input for investment values, interest percentages, and duration as defined in SKILL.md.
- Boundary markers: There are no explicit delimiters or boundary markers instructing the agent to isolate or ignore potentially malicious instructions embedded within these inputs.
- Capability inventory: The skill uses shell execution to run a Python script with user-supplied arguments, which is a potential command injection vector.
- Sanitization: The instructions do not specify sanitization or validation of the user input strings before they are interpolated into the shell command execution template.
Audit Metadata