@3182/earnings-surprise-detector
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/verify_earnings.pyexecutes a local helper script (mx_data.py) viasubprocess.runto retrieve quarterly financial data. - Evidence: The function
run_mx_dataconstructs a command list usingsys.executableand a relative path to themx-datatool, then executes it without a shell. - Note: This is a standard implementation for tool interaction within the agent environment and is protected against shell injection.
- [EXTERNAL_DOWNLOADS]: The skill specifies a dependency on the
openpyxlPython library in its configuration. - Evidence: The YAML frontmatter in
SKILL.mdlistsopenpyxlunder theinstallsection. - Note: This is a widely used and well-known package for processing Excel data files.
- [PROMPT_INJECTION]: The skill processes financial growth metrics retrieved from external financial platforms (such as Eastmoney) to inform the agent's recommendation workflow.
- Ingestion points: Quarterly earnings growth data fetched by the
mx-datatool inscripts/verify_earnings.py. - Boundary markers: Data is integrated into the final output using a structured template in
SKILL.md. - Capability inventory: Subprocess execution via
scripts/verify_earnings.py. - Sanitization: The script extracts numeric percentage values from the data using regular expressions before applying comparison logic.
- Note: As the data originates from well-known and reputable financial services, the risk of indirect prompt injection is minimal.
Audit Metadata