investment-research
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
tools/financial_rigor.py,tools/terminal_value.py,tools/report_audit.py) to perform precise financial valuations and verify data integrity. These commands are used for legitimate analytical purposes and rely on scripts within the project's own repository. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external financial websites (e.g., macrotrends, stockanalysis, aastocks, 东方财富) to populate its analysis.
- Ingestion points: External financial data sources are accessed during the "Data Collection" step in SKILL.md.
- Boundary markers: No specific prompt delimiters or warnings for the agent to ignore embedded instructions in the scraped data are present.
- Capability inventory: The skill utilizes
Bashfor command execution,Taskfor sub-agent management, andWritefor report generation. - Sanitization: The skill mitigates risks through a mandatory "Data Cross-Validation" step requiring two independent sources and programmatic verification via specialized tools to ensure data points are numeric and consistent.
- [DATA_EXPOSURE]: The skill creates a detailed investment report at
~/[公司名]投资研究报告.md. This is the intended primary output of the skill and does not involve the exfiltration of sensitive system or user data.
Audit Metadata