stock-analysis

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/analyze.py uses os.system to automate the installation of the requests library if it is missing and uses subprocess.call to orchestrate internal helper scripts for different analysis modes.
  • [EXTERNAL_DOWNLOADS]: The skill fetches article content and market data from the developer's infrastructure at redfox.hk. It also performs external package installation of the standard requests library via pip.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes financial articles fetched from an external API, which are subsequently interpolated into prompts for analysis and validation tasks.
  • Ingestion points: Article titles, summaries, and content are retrieved via the fetch_articles_paginated function in multiple scripts.
  • Boundary markers: Data is enclosed within markdown code blocks in the generated tasks provided to the LLM.
  • Capability inventory: The skill has the capability to execute shell commands via subprocess and os.system, and can write output files to the local output/ directory.
  • Sanitization: The skill relies on code block delimiters but does not perform explicit escaping or filtering of the fetched content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 04:51 AM
Security Audit — agent-trust-hub — stock-analysis