us-stock-researcher
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill handles external data from SEC filings which serves as an ingestion point for potential adversarial content. \n
- Ingestion points: SEC filings are downloaded from the EDGAR database using
scripts/download_sec_filings.py. \n - Boundary markers: The skill employs XML-style delimiters (e.g.,
<sec_filing>) in its prompt templates to separate instructions from external data. \n - Capability inventory: The skill can execute local Python scripts via
Bash, performWebSearch, andWritefiles to the filesystem. \n - Sanitization: A dedicated script
scripts/clean_sec_filing.pyremoves SGML tags, HTML metadata, binary data blocks, and zero-width characters before analysis. \n- [COMMAND_EXECUTION]: The skill performs legitimate command execution by running its local Python scripts to automate financial research workflows. These scripts use standard library functions for argument parsing and file management. \n- [EXTERNAL_DOWNLOADS]: The skill depends on established Python packages includinggoogle-genaiandsec-edgar-downloaderto interact with official APIs and regulatory databases.
Audit Metadata