financial-analysis-dcf

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches financial data from well-known and authoritative services for financial modeling purposes.\n
  • Fetches 10-K and 10-Q filings from the SEC EDGAR XBRL API (data.sec.gov).\n
  • Retrieves risk-free rate data from the Federal Reserve Economic Data (FRED) service (fred.stlouisfed.org).\n
  • Obtains stock quotes and market statistics from Yahoo Finance (finance.yahoo.com).\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external APIs, creating a potential attack surface for indirect prompt injection via the content of the fetched financial reports.\n
  • Ingestion points: External data is ingested in scripts/get_fundamentals.py, scripts/get_quote.py, and scripts/get_dcf.py using urllib.request.\n
  • Boundary markers: Data is parsed as structured formats (JSON and CSV); no specific LLM-level delimiters are applied to the external text within the skill body.\n
  • Capability inventory: The skill is limited to mathematical calculations and formatted data display; it possesses no capabilities for writing to the file system, spawning arbitrary shell commands, or performing outbound network POST requests to unknown domains.\n
  • Sanitization: Ticker symbols are normalized to uppercase, and all API responses are processed through standard library parsers (JSON/CSV) which prevents raw data injection into the execution logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 04:38 PM
Security Audit — agent-trust-hub — financial-analysis-dcf