nse-stock-analyzer
Warn
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts provided in the skill package, such as
scripts/generate_nse_report.py,scripts/fetch_prices.py, andscripts/calculate_valuations.py, to perform financial analysis and generate PDF reports. - [EXTERNAL_DOWNLOADS]: The skill retrieves stock prices and financial reports from external domains including
nse.co.ke,africanfinancials.com,afx.kwayisi.org, andstockanalysis.comusing thewebfetchandtavily_searchtools. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by processing untrusted data from external websites without sanitization or boundary markers.
- Ingestion points: Web content fetched from financial data providers using
webfetchandtavily(referenced inSKILL.md). - Boundary markers: There are no defined delimiters or instructions to ignore embedded prompts within the fetched data.
- Capability inventory: The skill possesses the ability to execute subprocesses (Python scripts), perform network operations, and write files (PDF report output).
- Sanitization: No data validation or escaping is applied to the external content before it is processed by the agent.
Audit Metadata