sec-edgar-api
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes text from SEC filings and search results via the Scavio API. Since this data is authored by third-party companies, it could theoretically contain hidden instructions intended to influence the agent's behavior.
- Ingestion points: Data retrieved from api.scavio.dev endpoints including /sec/search, /sec/filings, and /sec/company.
- Boundary markers: The skill does not define specific delimiters or instructions to wrap the retrieved external content.
- Capability inventory: The skill performs network API calls to fetch data; other capabilities depend on the agent's configuration.
- Sanitization: No specific filtering or sanitization of retrieved filing content is described in the skill instructions.
- [EXTERNAL_DOWNLOADS]: The documentation references the installation of the 'scavio' library for Python and Node.js. These are legitimate packages provided by the skill's vendor (scavio-ai) for interacting with the EDGAR API.
Audit Metadata