tase-stock-analysis

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The instructions in SKILL.md and SKILL_HE.md recommend that users install the TASE MCP server using the command npx github:skills-il/tase-mcp. This process involves downloading and executing code directly from the vendor's public repository to enable live data functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill is intended to process external data such as TASE market indices and Maya disclosure filings, which creates a potential surface for indirect prompt injection attacks.
  • Ingestion points: Data is brought into the agent's context through MCP tools like tase_get_maya_announcements or by the agent reading company reports and market summaries provided by external systems.
  • Boundary markers: The skill does not define specific delimiters or instructions to help the agent distinguish between its own logic and potentially adversarial instructions embedded in financial reports.
  • Capability inventory: The skill facilitates financial analysis and tax calculations, and provides the capability to perform network operations through the recommended MCP integration.
  • Sanitization: There is no evidence of sanitization or filtering logic applied to the content retrieved from external financial disclosure platforms like Maya.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 09:56 AM