etf-analyzer
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes fund data fetched from external sources, which presents a surface for indirect prompt injection.
- Ingestion points: scripts/provider.py fetches data from the yfinance library (Yahoo Finance).
- Boundary markers: The skill relies on ticker resolution instructions but does not provide explicit delimiters for ingested data.
- Capability inventory: The skill executes Python scripts and writes HTML files to the local file system via chart.py.
- Sanitization: Implemented robustly in scripts/htmlshell.py using textContent for dynamic elements and Unicode escaping in _safe_json to prevent XSS in generated HTML charts.
- [EXTERNAL_DOWNLOADS]: Fetches market data from Yahoo Finance (query2.finance.yahoo.com) using the yfinance package.
- [COMMAND_EXECUTION]: Runs local Python scripts (scripts/etf_holdings.py and scripts/chart.py) for data processing and chart generation.
Audit Metadata