tase-stock-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The instructions in
SKILL.mdandSKILL_HE.mdrecommend that users install the TASE MCP server using the commandnpx github:skills-il/tase-mcp. This process involves downloading and executing code directly from the vendor's public repository to enable live data functionality. - [INDIRECT_PROMPT_INJECTION]: The skill is intended to process external data such as TASE market indices and Maya disclosure filings, which creates a potential surface for indirect prompt injection attacks.
- Ingestion points: Data is brought into the agent's context through MCP tools like
tase_get_maya_announcementsor by the agent reading company reports and market summaries provided by external systems. - Boundary markers: The skill does not define specific delimiters or instructions to help the agent distinguish between its own logic and potentially adversarial instructions embedded in financial reports.
- Capability inventory: The skill facilitates financial analysis and tax calculations, and provides the capability to perform network operations through the recommended MCP integration.
- Sanitization: There is no evidence of sanitization or filtering logic applied to the content retrieved from external financial disclosure platforms like Maya.
Audit Metadata