institutional-flow-tracker
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to
financialmodelingprep.comto fetch 13F filing data. This is a well-known financial data service, and the use is consistent with the skill's primary purpose. No code or executables are downloaded. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external API (Financial Modeling Prep).
- Ingestion points: Data is fetched in
scripts/track_institutional_flow.pyandscripts/analyze_single_stock.pyvia thefmp_client.pymodule. - Boundary markers: The skill generates markdown reports from the data; it does not use explicit boundary markers to delimit external content for downstream agents.
- Capability inventory: The skill has the capability to write markdown files to the local filesystem and perform network operations to the FMP API.
- Sanitization: Data is parsed as JSON, and specific fields (e.g., share counts, company names) are extracted. While this provides implicit sanitization, there is no explicit filtering for natural language instructions embedded within text fields like company or investor names.
- [CREDENTIALS_SAFE]: The skill requires a Financial Modeling Prep API key. It correctly advises the use of environment variables and implements redaction logic in
scripts/fmp_client.pyto ensure the key is masked in error messages and logs.
Audit Metadata