finance-stock-video
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto callffmpegandffprobefor audio processing inscripts/regen_tts.py. It also instructs the agent to usepdftotextandgrepto extract and verify data from PDF reports. These operations are well-scoped and necessary for the skill's functionality.- [EXTERNAL_DOWNLOADS]: The skill downloads financial PDF reports fromcninfo.com.cnand fetches audio clips fromapi.marswave.ai. Both sources are reputable and relevant to the skill's purpose.- [DATA_EXFILTRATION]: The skill uses an API key for the ListenHub TTS service. The key is managed via environment variables and transmitted only to the authorized service provider (api.marswave.ai).- [PROMPT_INJECTION]: The skill processes external PDF reports which constitute an indirect injection surface. However, it incorporates robust safety practices to mitigate risk: - Ingestion points: External PDF reports downloaded from
cninfo.com.cn. - Boundary markers: Explicit instructions to verify all data against official originals using
grepon raw text. - Capability inventory: Subprocess calls for media tools (
ffmpeg), file downloads (curl), and PDF processing (pdftotext). - Sanitization: Strict adherence to objective reporting standards and mandatory inclusion of investment disclaimers.
Audit Metadata