longbridge-fundamentals

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external financial sources and web searches to perform company analysis, creating a surface for indirect prompt injection.
  • Ingestion points: Market data via longbridge CLI subcommands and supplementary info via WebSearch (e.g., in main-business-analysis.md and references/corporate-events.md).
  • Boundary markers: The skill lacks explicit instructions to treat incoming data as untrusted or to use delimiters to isolate external content.
  • Capability inventory: The agent can execute CLI tools, write/run Python code, and perform web searches.
  • Sanitization: No specific sanitization or filtering logic is prescribed for the ingested data before analysis.
  • [DYNAMIC_EXECUTION]: The skill utilizes runtime script generation and execution to perform financial calculations and modeling.
  • Evidence: Instructions in references/main-business-analysis.md and references/dcf.md provide Python code templates for calculating metrics such as CAGR, WACC, and HHI. The agent is directed to use these templates in a Python sandbox to process data fetched via the CLI.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 09:25 AM