xvary-stock-research
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches financial data and company filings from authoritative and well-known sources, specifically the SEC EDGAR system (sec.gov), Yahoo Finance, Finviz, and Stooq. These operations are essential for the skill's stated purpose and target legitimate public domains.
- [INDIRECT_PROMPT_INJECTION]: As the skill processes content from external websites and public filings, it is exposed to potential indirect prompt injection. To mitigate this, the instructions explicitly command the agent to treat all fetched data as untrusted evidence rather than instructions, which is a standard security countermeasure.
- [DATA_EXPOSURE]: The skill requires the setup of a
SEC_USER_AGENTenvironment variable to include a contact email, which is a mandatory requirement for accessing SEC EDGAR APIs. This is a standard compliance practice for financial data retrieval and does not involve the exfiltration of sensitive user information.
Audit Metadata