government-bond-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions utilize npx to fetch and execute tools from the vendor's official package (@nomadamas/k-skill). This is used for environment maintenance and instruction retrieval.
- [COMMAND_EXECUTION]: Analysis logic is executed via Node.js scripts and vendor CLI tools (scripts/cli.mjs). The operations are focused on financial data processing and report generation.
- [INDIRECT_PROMPT_INJECTION]: The skill has an indirect injection surface. Ingestion points: External news and schedule data files (news.mjs, schedule.mjs). Boundary markers: Absent. Capability inventory: Subprocess calls (harness.mjs), network operations (collect.mjs, ust.mjs), and file writes (render.mjs, dual.mjs). Sanitization: Rigorous validation of hostnames and cryptographic fingerprints (news.mjs, schedule.mjs).
- [SAFE]: Network calls are limited to official financial APIs from the Bank of Korea and the U.S. Treasury. API credentials are handled via environment variables (collect.mjs).
Audit Metadata