openbb
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
openbbpackage and its routers from PyPI, a well-known and standard package registry. - [COMMAND_EXECUTION]: Instructions include running
openbb-apiandopenbb-mcpto expose financial data tools locally. These commands are appropriately restricted to the loopback address (127.0.0.1) to prevent unauthorized network access. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external financial providers such as Nasdaq, the SEC, and FRED, which creates an attack surface for indirect injection.
- Ingestion points: Data is fetched from various remote financial data providers using the
openbbPython client (SKILL.md). - Boundary markers: None explicitly defined in the instructions; the skill relies on the library's internal parsing.
- Capability inventory: Financial market data retrieval, fundamental analysis, and technical indicator calculation.
- Sanitization: Data is processed via structured DataFrames, which reduces the risk of direct command injection from the data itself.
Audit Metadata