stock-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches live market data, company profiles, and regulatory filings from the official SandBase API at api.sandbase.ai. This external communication is the primary function of the skill and targets infrastructure managed by the skill's author, sandbaseai.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external financial records and filings. To mitigate associated risks, the instructions mandate separating sourced facts from interpretation, alignment of comparison series to common trading dates, and the maintenance of an evidence ledger. Ingestion points include the SandBase API responses for company identity, price history, and SEC filings. Capability inventory includes network requests to the SandBase API via MCP and REST transports.
- [DYNAMIC_EXECUTION]: The skill implements a runtime discovery process to identify available API capabilities, inspect their schemas, and execute calls based on discovered parameters. This process is constrained to the vendor's API environment and includes cost-transparency checks before batch execution.
- [CREDENTIALS_UNSAFE]: While the skill uses an API key (SANDBASE_API_KEY), it explicitly instructs the agent never to ask the user for the key or expose it in logs, following secure secret management practices.
Audit Metadata