dcf-model
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection due to its reliance on external data ingestion.
- Ingestion points: The skill retrieves financial data from MCP servers, user-provided documents, and web searches as part of its data retrieval workflow in SKILL.md.
- Boundary markers: The instructions lack delimiters or specific warnings to ignore instructions that may be embedded within the retrieved external financial reports.
- Capability inventory: The skill has the capability to write Excel files using the xlsx platform tool and perform network operations via the yfinance and requests libraries (requirements.txt, SKILL.md).
- Sanitization: No explicit validation, escaping, or filtering of the processed financial data is mentioned in the instructions or scripts.
- [EXTERNAL_DOWNLOADS]: Fetches market and financial data from well-known services.
- Description: The skill uses yfinance and requests to fetch stock metrics and historical financials from established providers for modeling purposes (SKILL.md, requirements.txt).
- Usage: These operations are consistent with the primary purpose of the skill and do not involve the execution of remote scripts.
Audit Metadata