tax-aware-rebalancing-planner
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using python to run scripts located in a sibling directory (../findata-toolkit/scripts/) for fetching stock data, SEC filings, and macro-economic information.
- [EXTERNAL_DOWNLOADS]: Environment setup instructions include installing dependencies via pip from a local requirements file (../findata-toolkit/requirements.txt), which involves downloading packages from the public PyPI registry.
- [PROMPT_INJECTION]: The skill uses instructional framing to define a professional persona ("Act as a professional research and risk analyst") and a structured workflow for financial analysis. These are standard task-oriented instructions without safety bypass patterns.
- [PROMPT_INJECTION]: The skill possesses an indirect injection surface as it processes data from external sources like SEC EDGAR. 1. Ingestion points: Data retrieved via stock_data.py and sec_edgar.py scripts. 2. Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the processing flow. 3. Capability inventory: The skill has shell execution capabilities for running analysis scripts. 4. Sanitization: No specific sanitization or validation logic is defined for external data inputs.
Audit Metadata