stock-recap
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local scripts provided in the skill directory using Node.js (
gather.mjs) and Python (render_chart.py) to aggregate data and generate visualizations.- [EXTERNAL_DOWNLOADS]: The skill requires the installation of themplfinanceandpandasPython packages. It also retrieves financial data and institutional activity from external API services including TraderDaddy Pro and TickerTrace.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, which constitutes a potential attack surface where malicious content could influence agent behavior. - Ingestion points: Data is ingested from multiple API endpoints providing screener results, options flows, and 13F hedge fund data (SKILL.md).
- Boundary markers: No delimiters or instructions are used to separate external data from agent commands or to prevent the agent from following embedded instructions.
- Capability inventory: The skill execution environment allows for shell command execution, network requests, and file system interaction.
- Sanitization: No content validation or sanitization is mentioned for the data retrieved from the financial APIs before it is analyzed by the agent.
Audit Metadata