fundamentals
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes financial data from Yahoo Finance, which is a standard surface for indirect prompt injection.
- Ingestion points: Data is fetched from Yahoo Finance via the trading_skills library in the scripts fundamentals.py and piotroski.py.
- Boundary markers: The output is structured as JSON but does not use specific delimiters to protect against instructions embedded in external data.
- Capability inventory: The skill scripts are limited to data retrieval and analysis; they do not have network exfiltration or system modification capabilities.
- Sanitization: Input ticker symbols are converted to uppercase before use.
Audit Metadata