ib-portfolio-action-report
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
scripts/report.pyto aggregate portfolio data and perform risk analysis. This is a core part of the skill's functionality. - [EXTERNAL_DOWNLOADS]: The skill depends on
yfinance, which downloads stock market data from Yahoo Finance. This is an established and well-known service used for its primary function. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from Interactive Brokers and market data sources. There is a potential vulnerability surface where malicious metadata in external data (like stock descriptions) could influence the generated report.
- Ingestion points: Data enters the agent's context through the
scripts/report.pyscript, which fetches account information and market data fromyfinanceand the Interactive Brokers API. - Boundary markers: The markdown template
templates/markdown-template.mduses direct interpolation for position details and recommendations without specific delimiters or warnings to ignore instructions inside the data. - Capability inventory: The skill uses subprocess calls to run Python scripts, performs network requests via market data libraries, and writes files to the
sandbox/directory. - Sanitization: The provided files do not show explicit validation or sanitization of the data retrieved from external APIs before it is included in the final report.
Audit Metadata