peer-comparison
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves financial data, tickers, and company information from well-known services including the U.S. Securities and Exchange Commission (sec.gov) and StockAnalysis.com. These operations are part of the intended financial analysis functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests and processes content from external web sources and search results.
- Ingestion points: Financial metrics and business descriptions are fetched from SEC API endpoints, StockAnalysis.com, and WebSearch results as described in SKILL.md.
- Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between the skill's trusted instructions and potentially untrusted data retrieved from external sources.
- Capability inventory: The skill relies on network fetching and search tools to collect data, which is then summarized and presented to the user.
- Sanitization: The instructions do not specify any validation or sanitization routines for the data fetched from the external sources before it is incorporated into the agent's response.
Audit Metadata