nse-stock-analyzer

Warn

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Python scripts provided in the skill package, such as scripts/generate_nse_report.py, scripts/fetch_prices.py, and scripts/calculate_valuations.py, to perform financial analysis and generate PDF reports.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves stock prices and financial reports from external domains including nse.co.ke, africanfinancials.com, afx.kwayisi.org, and stockanalysis.com using the webfetch and tavily_search tools.
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by processing untrusted data from external websites without sanitization or boundary markers.
  • Ingestion points: Web content fetched from financial data providers using webfetch and tavily (referenced in SKILL.md).
  • Boundary markers: There are no defined delimiters or instructions to ignore embedded prompts within the fetched data.
  • Capability inventory: The skill possesses the ability to execute subprocesses (Python scripts), perform network operations, and write files (PDF report output).
  • Sanitization: No data validation or escaping is applied to the external content before it is processed by the agent.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 18, 2026, 02:56 AM