report-stock
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Python scripts using
uv run pythonto gather stock data (scripts/report.py) and to convert generated markdown reports into PDF format (.claude/skills/markdown-to-pdf/scripts/markdown_to_pdf.py). These are standard operations for its stated purpose. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: User-provided stock symbols via the
symbolsargument and external financial data retrieved from thetrading_skillslibrary. - Boundary markers: The agent is instructed to follow a specific structure defined in
templates/markdown-template.md, which helps constrain the output format. - Capability inventory: The skill has the ability to execute subprocesses (Python scripts) and write files to the
sandbox/directory. - Sanitization: Ticker symbols are normalized to uppercase in
scripts/report.py, but the skill relies on the underlyingtrading_skillslibrary and the LLM's adherence to the template to manage the safety of the external financial data content.
Audit Metadata