dual-listed-arbitrage
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests market data from external sources via the yfinance library. This potential attack surface is well-mitigated through the use of
html.escape()andjson.dumps()in the visualization script (scripts/viz.py), which prevents untrusted data from executing scripts in the generated HTML reports. Additionally, the skill includes clear legal disclaimers advising users to verify all figures against official sources. - [EXTERNAL_DOWNLOADS]: The skill fetches financial data from well-known and appropriate sources, including Yahoo Finance (via the yfinance library), the Tel Aviv Stock Exchange (TASE), and the Bank of Israel. These references are standard for the skill's primary purpose of financial analysis.
- [COMMAND_EXECUTION]: The skill uses Python scripts to perform currency-adjusted calculations and generate interactive HTML charts. The execution is scoped to the skill's internal logic and includes sanity checks (e.g., detecting 100x scaling errors common with agorot-to-shekel conversions) to ensure the integrity of the processed data.
- [SAFE]: The skill uses clear, non-deceptive instructions and documentation in both English and Hebrew. All external resource references trace back to official financial institutions or established development repositories.
Audit Metadata