fundamental-report
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches company mapping data and financial overviews from official and well-known financial services.
- Evidence: References
https://www.sec.gov/files/company_tickers.jsonandhttps://stockanalysis.com/stocks/{ticker}/for ticker resolution and metadata gathering. - [COMMAND_EXECUTION]: Orchestrates a complex workflow by dispatching 17 parallel sub-agent tasks using the Agent tool.
- Evidence: Launches a wide array of analysis skills (e.g.,
income-statement-analysis,valuation-analysis) and utility agents (signal-rater) to compile the report. - [INDIRECT_PROMPT_INJECTION]: The skill processes large amounts of external, untrusted data which is then interpolated into prompts for sub-agents and a final report file.
- Ingestion points: Data is ingested from external SEC JSON files, third-party stock analysis websites, and the outputs of 17 different sub-agent skills.
- Boundary markers: No explicit delimiters or boundary markers are defined to isolate external data from the skill's instructions.
- Capability inventory: The skill utilizes the
Agenttool for task dispatch,WebFetchfor network access, and theWritetool to save reports to the local filesystem. - Sanitization: The instructions do not specify any validation or sanitization steps for the data retrieved from external URLs before it is processed or written to a file.
Audit Metadata