kanchi-dividend-sop
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill scripts ingest data from user-supplied JSON and CSV files to identify stock tickers for analysis. While this represents a data ingestion surface, the scripts strictly normalize inputs to uppercase strings and use them solely for API queries and report generation. There is no evidence of unsafe interpolation or execution of this data.
- Ingestion points:
scripts/build_entry_signals.pyandscripts/build_sop_plan.pyread ticker data from files via the--inputflag. - Boundary markers: Standard JSON and CSV parsing is utilized; no explicit prompt boundary markers are used in the generated markdown output.
- Capability inventory: Capabilities are limited to file writing and network requests to a financial API.
- Sanitization: Input tickers are stripped of whitespace and converted to uppercase.
- [EXTERNAL_DOWNLOADS]: The script
build_entry_signals.pyconnects to the Financial Modeling Prep (FMP) API to retrieve real-time price and dividend metrics. This is a well-known financial service required for the skill's stated functionality.
Audit Metadata