israeli-company-valuation
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONTIME_DELAYED_CONDITIONAL
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze untrusted external data, specifically shareholders' agreements and articles of association (Step 0), to identify clauses that might override valuation models. This introduces a surface for indirect prompt injection if the processed documents contain instructions intended to manipulate the agent's behavior. The risk is mitigated by the skill's rigid 10-step workflow and the requirement to wrap all outputs in a prominent 'mandatory scope limit' and legal notice. Each output must be preceded and followed by a disclaimer stating the indicative nature of the valuation.\n
- Ingestion points: The agent reads user-provided corporate documents in Step 0 of the valuation process.\n
- Boundary markers: The skill requires a mandatory 'Legal notice' and 'Scope limit' at the top and bottom of every response to prevent confusion between AI-generated drafts and professional advice.\n
- Capability inventory: The bundled
scripts/valuation_model.pyperforms mathematical calculations and prints results; it lacks network or persistent filesystem access.\n - Sanitization: The skill relies on the agent following a strict multi-step instructional framework and providing clear disclaimers regarding the indicative and pre-tax nature of the output.\n- [TIME_DELAYED_CONDITIONAL]: The bundled
scripts/valuation_model.pyincludes a logic check that compares the system date against a hardcoded data vintage ('2026-07-09'). If the internal country risk data is older than 180 days, the script outputs a warning to the user. This is a benign feature designed to ensure financial calculations remain accurate and do not rely on stale market parameters.
Audit Metadata