stockbee-momentum-burst-screener
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from a financial API and local JSON files, which represents an attack surface where malicious instructions could theoretically be embedded in data fields.
- Ingestion points: Data is ingested through
FMPClient._requestinscripts/screen_momentum_burst.py(fetching from Financial Modeling Prep API) andread_prices_json(loading local files). - Boundary markers: The skill does not explicitly use delimiters or instruction-ignore blocks when presenting the processed stock data to the agent context.
- Capability inventory: The skill performs network reads via
requests.getand writes analysis reports to the local filesystem usingPath.write_textinscripts/screen_momentum_burst.py. - Sanitization: The script performs strict numeric conversion using
to_floatandto_inthelper functions, and normalizes ticker symbols, which significantly mitigates the risk of non-numeric data injection within OHLCV bars. - [EXTERNAL_DOWNLOADS]: The script fetches stock market data from a well-known financial service provider at runtime.
- Evidence:
FMPClientinscripts/screen_momentum_burst.pymakes HTTP GET requests tofinancialmodelingprep.comto retrieve company universe and historical price data. - Context: These network operations are the primary function of the skill and target a recognized financial data service.
- [COMMAND_EXECUTION]: The skill provides instructions for the user or agent to execute a Python script to perform the screening.
- Evidence:
SKILL.mdcontains command-line examples such aspython3 skills/stockbee-momentum-burst-screener/scripts/screen_momentum_burst.py --fmp-universe. - Context: The execution is limited to the provided script and is intended for local data analysis and report generation.
Audit Metadata