finance-stock-video

Pass

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to call ffmpeg and ffprobe for audio processing in scripts/regen_tts.py. It also instructs the agent to use pdftotext and grep to extract and verify data from PDF reports. These operations are well-scoped and necessary for the skill's functionality.- [EXTERNAL_DOWNLOADS]: The skill downloads financial PDF reports from cninfo.com.cn and fetches audio clips from api.marswave.ai. Both sources are reputable and relevant to the skill's purpose.- [DATA_EXFILTRATION]: The skill uses an API key for the ListenHub TTS service. The key is managed via environment variables and transmitted only to the authorized service provider (api.marswave.ai).- [PROMPT_INJECTION]: The skill processes external PDF reports which constitute an indirect injection surface. However, it incorporates robust safety practices to mitigate risk:
  • Ingestion points: External PDF reports downloaded from cninfo.com.cn.
  • Boundary markers: Explicit instructions to verify all data against official originals using grep on raw text.
  • Capability inventory: Subprocess calls for media tools (ffmpeg), file downloads (curl), and PDF processing (pdftotext).
  • Sanitization: Strict adherence to objective reporting standards and mandatory inclusion of investment disclaimers.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 28, 2026, 05:37 AM
Security Audit — agent-trust-hub — finance-stock-video