financial-analysis-earnings
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or persistence mechanisms were detected in the skill instructions or scripts.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from web search results and external financial APIs.
- Ingestion points: Web search results (SKILL.md), SEC EDGAR XBRL API (get_fundamentals.py), and Yahoo Finance endpoints (get_quote.py).
- Boundary markers: None explicitly implemented to delimit untrusted data in the prompt context.
- Capability inventory: Shell execution via
run.shto trigger local Python scripts and network operations usingurllib.requestto fetch data from known financial domains. - Sanitization: No specific sanitization or filtering is applied to the incoming JSON/text data before processing.
- Assessment: This is a low-risk functional surface inherent to data retrieval tools; the skill does not possess high-privilege capabilities that would make this vulnerability critical.
Audit Metadata