stockbee-20pct-study
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads financial market data and catalyst news from Financial Modeling Prep (financialmodelingprep.com), which is a well-known service for market data. This activity is central to the skill's stated purpose of stock market research.\n- [CREDENTIALS_UNSAFE]: The skill requires an API key for the data provider. It correctly handles this by allowing the user to provide the key via an environment variable (FMP_API_KEY) or a command-line argument, ensuring that sensitive credentials are not hardcoded within the skill's source code.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted news content from external JSON files to enrich study records with catalyst classifications.\n
- Ingestion points: The news-json input in scripts/run_20pct_study.py.\n
- Boundary markers: News text is normalized and truncated to 500 characters before being stored in reports.\n
- Capability inventory: The skill performs local file writes to report and state directories but lacks dangerous capabilities such as arbitrary command execution, dynamic code evaluation, or unauthorized network exfiltration.\n
- Sanitization: Data is categorized using static keyword-based classification logic rather than execution-triggering logic.\n- [SAFE]: All components of the skill, including the technical context scoring and cohort summarization, are implemented using transparent Python logic. There are no persistence mechanisms, privilege escalation attempts, or obfuscated sections detected.
Audit Metadata