concept-board-analyzer
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands to manage environment states and run data retrieval scripts, specifically 'source ../../.venv/bin/activate' and 'python ../findata-toolkit-cn/scripts/views_runner.py'.
- [EXTERNAL_DOWNLOADS]: The skill initiates package installation via 'pip install' from a local requirements file, which involves downloading third-party dependencies from public registries like PyPI.
- [INDIRECT_PROMPT_INJECTION]: A vulnerability surface exists where user-supplied inputs (symbols, dates) are used to construct CLI commands. The ingestion points include the 'symbol' and 'period' parameters, there are no boundary markers or explicit sanitization instructions, and the skill possesses the capability to execute scripts via subprocess calls.
Audit Metadata