glmv-stock-analyst
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches financial data, K-line charts, and analyst reports from well-known providers such as EastMoney (eastmoney.com), Yahoo Finance, and Cailianpress. These downloads are restricted to reputable financial sources and official PDF servers required for stock analysis.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data including news articles and corporate PDFs, which presents a surface for potential injection attacks. Ingestion points: External news summaries and PDF research reports processed in
fetch_all.pyandfetch_ir.py. Boundary markers: Instructions specify separating evidence from judgment in the report, though explicit delimiters for untrusted input are not defined. Capability inventory: The skill performs network reads from financial APIs and writes analysis files (JSON, HTML, PDF) to the workspace. Sanitization: PDF extraction infetch_ir.pyis constrained by protocol (HTTPS only), file size (50MB maximum), and page count (50 pages maximum) to reduce processing risk. - [COMMAND_EXECUTION]: The skill utilizes local scripts (
setup.sh,fetch_all.py, etc.) for data collection and report formatting. These scripts operate within a standard user context using a local virtual environment and do not require elevated privileges.
Audit Metadata