sec-filing-reviewer
Warn
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill recommends using
npx clawhub install sec-filing-reviewer. This downloads and executes a package fromclawhub, which is not a recognized software registry, representing a risk of unverified code execution. - [EXTERNAL_DOWNLOADS]: The skill setup requires downloading multiple external Python dependencies and a CLI tool from a non-standard source.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to summarize and analyze SEC filings, creating an attack surface for instructions embedded in external documents.
- Ingestion points: SEC filings (10-K, 10-Q, 8-K) specified in SKILL.md.
- Boundary markers: None; there are no clear delimiters or instructions to ignore data-embedded commands.
- Capability inventory: The skill can read local file data using scripts/review_filing.py.
- Sanitization: No input sanitization or filtering is performed on the filing content.
Audit Metadata