investment-checklist

Pass

Audited by Gen Agent Trust Hub on Jul 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using python3 to run a local utility (~/ai-berkshire/tools/financial_rigor.py) for financial verification and scenario analysis.
  • [EXTERNAL_DOWNLOADS]: The skill uses WebSearch and the Task tool to fetch live financial data and company news from the internet.
  • [PROMPT_INJECTION]: The skill exhibits a surface for Indirect Prompt Injection.
  • Ingestion points: Untrusted data (financial metrics, CEO names, news) enters the context via WebSearch and background Agent tasks in Step 2.
  • Boundary markers: Absent; the skill does not use delimiters or instructions to treat external data as untrusted text.
  • Capability inventory: The skill has access to the Bash tool for command execution and can write files to the home directory (~/巴菲特Checklist-...).
  • Sanitization: Absent; external data points like {股价} or {EPS} are directly interpolated into the python3 shell command strings in Step 3.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 4, 2026, 07:38 AM
Security Audit — agent-trust-hub — investment-checklist