skills/quantskills/skill-global-commodity-term-structure/global-commodity-term-structure/Gen Agent Trust Hub
global-commodity-term-structure
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch data from well-known and reputable financial services, including Yahoo Finance, CME Group, ICE, and LME. These operations are essential for the skill's primary function and target established domains for data extraction.
- [COMMAND_EXECUTION]: The skill utilizes a local Python script,
scripts/validate_report.py, to ensure generated reports meet specific structural requirements. Analysis of the script confirms it uses only the Python standard library and performs no unsafe operations. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes data from external web pages.
- Ingestion points: External financial data from specified venues (Yahoo Finance, exchange sites) enters the agent context via browser tools.
- Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are used for the external content.
- Capability inventory: The agent has browsing capabilities and access to the local shell for executing the provided validation script.
- Sanitization: The workflow relies on the agent to extract specific numerical data, providing inherent protection against instructional content.
- [SAFE]: No malicious patterns, such as prompt injection, data exfiltration, or obfuscation, were detected. The skill's behavior is consistent with its stated purpose of commodity market analysis.
Audit Metadata