industry-performance-snapshot
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The setup guide includes instructions to download and execute the Homebrew installation script from a well-known source to satisfy environment prerequisites.
- [REMOTE_CODE_EXECUTION]: The skill instructions utilize
npxto download and run theoctagon-mcppackage, which is an expected behavior for installing MCP servers from the vendor. - [EXTERNAL_DOWNLOADS]: The documentation references external scripts and packages from official registries and trusted repositories for tool configuration.
- [CREDENTIALS_UNSAFE]: The configuration examples demonstrate passing the
OCTAGON_API_KEYthrough command-line environment variables, which is a standard method for local tool setup. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external market data retrieved via a tool. 1. Ingestion points: Data outputs from the
octagon-agenttool described inSKILL.md. 2. Boundary markers: Not specified in the current instruction set. 3. Capability inventory: The configured agent has access to financial research tools and network capabilities provided by the MCP server. 4. Sanitization: The instructions do not explicitly mention sanitization of the retrieved industry performance data.
Audit Metadata