stock-event-research
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
scripts/em.pyto fetch market data and news from external sources like EastMoney and Sina. This is a standard functional component of the skill.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external news feeds and financial announcements, which could theoretically contain malicious instructions. - Ingestion points: News articles, announcements, and market flash data retrieved from external sources via
scripts/em.py. - Boundary markers: No explicit delimiters or boundary instructions are provided to the agent to isolate the fetched content.
- Capability inventory: Capabilities are limited to data retrieval and analysis; no destructive or sensitive operations were identified.
- Sanitization: The skill does not document any specific sanitization or filtering logic for the retrieved external data.
Audit Metadata