financial-report-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill transmits the content of user-provided financial reports and the
SOMARK_API_KEYto the vendor's API atsomark.cnorsomark.aifor parsing. This behavior is the intended functionality of the skill and aligns with the vendor's provided services. - [COMMAND_EXECUTION]: The skill executes a local Python script,
financial_report_analyzer.py, which is used to manage the API interaction and save the resulting Markdown and JSON files to the local filesystem. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted documents provided by the user, which presents a surface for indirect instructions designed to influence AI output.
- Ingestion points: The script
financial_report_analyzer.pyreads user-specified files from the local disk via the-fflag. - Boundary markers: The
SKILL.mdfile contains explicit instructions to the AI agent to treat all parsed document content strictly as data and to avoid executing any embedded instructions. - Capability inventory: The skill possesses the capability to read local files, write parsed results to the local filesystem, and perform network requests to the SoMark API endpoints.
- Sanitization: The raw input (such as PDFs or images) is parsed into structured Markdown and JSON formats by the SoMark service before the AI processes the results.
Audit Metadata