sec-risk-factors
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation guides the user to fetch the official Homebrew installation script from GitHub. It also utilizes the
npxutility to download and run theoctagon-mcppackage from a public registry as part of its standard setup process. - [COMMAND_EXECUTION]: The skill instructions include shell commands for installing the skill, configuring the environment with an API key, and launching the MCP server. These commands are necessary for the skill's integration with the AI agent's environment.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external content from SEC 10-K and 10-Q filings to perform its analysis.
- Ingestion points: Data is ingested from external SEC filing reports via the
octagon-agenttool (SKILL.md). - Boundary markers: No explicit delimiters or boundary markers for external data are specified in the prompts.
- Capability inventory: The skill is designed for data analysis and categorization; it does not contain code that performs direct file system writes or unauthorized network operations.
- Sanitization: The skill does not mention specific sanitization or filtering of the retrieved SEC filing content.
Audit Metadata