stock-sector-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is configured to execute a local Python script
scripts/em.pyto fetch stock market rankings, news, and sector-specific details through various command-line operations. - [INDIRECT_PROMPT_INJECTION]: The instructions establish a workflow where untrusted user input (sector names and queries) is interpolated directly into command-line arguments, creating a potential injection surface.
- Ingestion points: User-provided queries are passed to the
--queryflag inscripts/em.py search_sectorsand sector names to the--board-nameflag inget_sector_detailwithinSKILL.md. - Boundary markers: The instructions lack specific delimiters or warnings to treat embedded data as untrusted content.
- Capability inventory: The skill relies on shell command execution via
python scripts/em.pyto perform its primary functions. - Sanitization: There is no evidence of input validation or sanitization defined within the skill's instructional framework.
Audit Metadata