public-equity-investing
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Indirect Prompt Injection Surface: The skill is designed to ingest and process untrusted external data such as earnings transcripts, company filings, and investor presentations. This data is interpolated into the agent's context, which could potentially influence agent behavior if the source materials contain malicious instructions.
- Ingestion Points: Workflows such as
earnings-deep-diveandfinancials-normalizerread and analyze text from transcripts and tabular data from spreadsheets. - Boundary Markers: The skill utilizes an evidence-control layer (
financial-source-of-truth) to label claims and distinguish between reported facts and management statements, providing a logical but not cryptographic boundary between content types. - Capability Inventory: The agent possesses the capability to execute bundled Python scripts to clean and process this data.
- Sanitization: Relies on analytical reconciliation and manual evidence labeling rather than automated input sanitization for natural language content.
- Local Command Execution: The skill instructs the agent to execute shell commands to run bundled Python scripts for data profiling, cleaning, and dashboard rendering.
- Execution Pattern: Instructions in
INTERNAL.mdfiles provide specific command-line examples (e.g.,python scripts/clean_tabular_data.py) for the agent to follow when processing user-provided files. - Context: These commands are used to invoke deterministic local tools that are part of the skill package and do not appear to involve arbitrary user input flowing directly into shell execution without the agent's mediation.
- External Data Sourcing: The skill provides guidance for calling external financial data providers such as Daloopa and Quartr.
- Pattern: Detailed playbooks describe how to shape requests to these connectors to retrieve financial statements, KPIs, and document snippets.
- Context: These are recognized technology services used as intended for the public equity research domain.
Audit Metadata