financial-analysis-dcf
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches financial data from well-known and authoritative services for financial modeling purposes.\n
- Fetches 10-K and 10-Q filings from the SEC EDGAR XBRL API (data.sec.gov).\n
- Retrieves risk-free rate data from the Federal Reserve Economic Data (FRED) service (fred.stlouisfed.org).\n
- Obtains stock quotes and market statistics from Yahoo Finance (finance.yahoo.com).\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external APIs, creating a potential attack surface for indirect prompt injection via the content of the fetched financial reports.\n
- Ingestion points: External data is ingested in
scripts/get_fundamentals.py,scripts/get_quote.py, andscripts/get_dcf.pyusingurllib.request.\n - Boundary markers: Data is parsed as structured formats (JSON and CSV); no specific LLM-level delimiters are applied to the external text within the skill body.\n
- Capability inventory: The skill is limited to mathematical calculations and formatted data display; it possesses no capabilities for writing to the file system, spawning arbitrary shell commands, or performing outbound network POST requests to unknown domains.\n
- Sanitization: Ticker symbols are normalized to uppercase, and all API responses are processed through standard library parsers (JSON/CSV) which prevents raw data injection into the execution logic.
Audit Metadata