tech-earnings-deepdive
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions require the agent to process various external data sources, creating a vulnerability surface where malicious instructions could be embedded in the analyzed content.\n
- Ingestion points: Data is sourced from SEC filings (10-K, 10-Q, 8-K), CEO quotes, employee reviews (Glassdoor, Blind), and customer feedback (G2, AppStore) as specified in the evidence collection modules (A-P).\n
- Boundary markers: The prompt does not define specific delimiters or "ignore embedded instructions" directives to isolate the external data from the analysis logic.\n
- Capability inventory: The agent is expected to fetch and synthesize data from multiple online platforms and referenced local files to populate the 16 analysis modules.\n
- Sanitization: There are no instructions for sanitizing, validating, or filtering external content to mitigate the risk of hidden commands within the data.\n- [EXTERNAL_DOWNLOADS]: The skill includes external links in its promotional footer targeting well-known services.\n
- Evidence: Links to X (Twitter) profiles for Ruby and Star, and a GitHub repository link to
https://github.com/star23/Day1Global-Skills/.\n - Context: These links point to resources managed by the skill's author (star23) and are documented here as vendor-owned resources.
Audit Metadata