stockbee-momentum-burst-screener

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from a financial API and local JSON files, which represents an attack surface where malicious instructions could theoretically be embedded in data fields.
  • Ingestion points: Data is ingested through FMPClient._request in scripts/screen_momentum_burst.py (fetching from Financial Modeling Prep API) and read_prices_json (loading local files).
  • Boundary markers: The skill does not explicitly use delimiters or instruction-ignore blocks when presenting the processed stock data to the agent context.
  • Capability inventory: The skill performs network reads via requests.get and writes analysis reports to the local filesystem using Path.write_text in scripts/screen_momentum_burst.py.
  • Sanitization: The script performs strict numeric conversion using to_float and to_int helper functions, and normalizes ticker symbols, which significantly mitigates the risk of non-numeric data injection within OHLCV bars.
  • [EXTERNAL_DOWNLOADS]: The script fetches stock market data from a well-known financial service provider at runtime.
  • Evidence: FMPClient in scripts/screen_momentum_burst.py makes HTTP GET requests to financialmodelingprep.com to retrieve company universe and historical price data.
  • Context: These network operations are the primary function of the skill and target a recognized financial data service.
  • [COMMAND_EXECUTION]: The skill provides instructions for the user or agent to execute a Python script to perform the screening.
  • Evidence: SKILL.md contains command-line examples such as python3 skills/stockbee-momentum-burst-screener/scripts/screen_momentum_burst.py --fmp-universe.
  • Context: The execution is limited to the provided script and is intended for local data analysis and report generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 05:42 PM
Security Audit — agent-trust-hub — stockbee-momentum-burst-screener