glmv-stock-analyst

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches financial data, K-line charts, and analyst reports from well-known providers such as EastMoney (eastmoney.com), Yahoo Finance, and Cailianpress. These downloads are restricted to reputable financial sources and official PDF servers required for stock analysis.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data including news articles and corporate PDFs, which presents a surface for potential injection attacks. Ingestion points: External news summaries and PDF research reports processed in fetch_all.py and fetch_ir.py. Boundary markers: Instructions specify separating evidence from judgment in the report, though explicit delimiters for untrusted input are not defined. Capability inventory: The skill performs network reads from financial APIs and writes analysis files (JSON, HTML, PDF) to the workspace. Sanitization: PDF extraction in fetch_ir.py is constrained by protocol (HTTPS only), file size (50MB maximum), and page count (50 pages maximum) to reduce processing risk.
  • [COMMAND_EXECUTION]: The skill utilizes local scripts (setup.sh, fetch_all.py, etc.) for data collection and report formatting. These scripts operate within a standard user context using a local virtual environment and do not require elevated privileges.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 07:34 AM