fundamental-report

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches company mapping data and financial overviews from official and well-known financial services.
  • Evidence: References https://www.sec.gov/files/company_tickers.json and https://stockanalysis.com/stocks/{ticker}/ for ticker resolution and metadata gathering.
  • [COMMAND_EXECUTION]: Orchestrates a complex workflow by dispatching 17 parallel sub-agent tasks using the Agent tool.
  • Evidence: Launches a wide array of analysis skills (e.g., income-statement-analysis, valuation-analysis) and utility agents (signal-rater) to compile the report.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes large amounts of external, untrusted data which is then interpolated into prompts for sub-agents and a final report file.
  • Ingestion points: Data is ingested from external SEC JSON files, third-party stock analysis websites, and the outputs of 17 different sub-agent skills.
  • Boundary markers: No explicit delimiters or boundary markers are defined to isolate external data from the skill's instructions.
  • Capability inventory: The skill utilizes the Agent tool for task dispatch, WebFetch for network access, and the Write tool to save reports to the local filesystem.
  • Sanitization: The instructions do not specify any validation or sanitization steps for the data retrieved from external URLs before it is processed or written to a file.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 07:26 AM
Security Audit — agent-trust-hub — fundamental-report