stockbee-exhaustion-hammer-screener
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches financial data from Financial Modeling Prep (FMP). These requests are directed to financialmodelingprep.com, a well-known financial data provider.
- [CREDENTIALS_UNSAFE]: The skill accesses the FMP API key through the FMP_API_KEY environment variable. This is a standard and safe method for managing secrets and avoids hardcoding sensitive information.
- [COMMAND_EXECUTION]: The test suite (scripts/tests/test_screen_exhaustion_hammer.py) uses subprocess.run to execute the skill's main script for functional testing. The command is constructed using a list, which avoids shell invocation and prevents command injection.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external symbol lists and price data from user-provided files. While this creates a theoretical surface for indirect prompt injection, the data is parsed as structured JSON or CSV, and the skill's capabilities are limited to financial analysis and report generation.
- Ingestion points: Symbols and price data are read from files via --prices-json, --profiles-json, and --universe-file arguments.
- Boundary markers: Data is delimited and parsed using standard Python libraries (json, csv).
- Capability inventory: The skill performs network requests to FMP and writes analysis reports to a local directory.
- Sanitization: Input symbols are normalized to a consistent uppercase format.
Audit Metadata