longbridge-fundamentals
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external financial sources and web searches to perform company analysis, creating a surface for indirect prompt injection.
- Ingestion points: Market data via
longbridgeCLI subcommands and supplementary info via WebSearch (e.g., inmain-business-analysis.mdandreferences/corporate-events.md). - Boundary markers: The skill lacks explicit instructions to treat incoming data as untrusted or to use delimiters to isolate external content.
- Capability inventory: The agent can execute CLI tools, write/run Python code, and perform web searches.
- Sanitization: No specific sanitization or filtering logic is prescribed for the ingested data before analysis.
- [DYNAMIC_EXECUTION]: The skill utilizes runtime script generation and execution to perform financial calculations and modeling.
- Evidence: Instructions in
references/main-business-analysis.mdandreferences/dcf.mdprovide Python code templates for calculating metrics such as CAGR, WACC, and HHI. The agent is directed to use these templates in a Python sandbox to process data fetched via the CLI.
Audit Metadata