trade-report-pdf
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the terminal to discover files (
ls -la TRADE-*.md) and execute a localized Python script (python3 ~/.hermes/skills/trade/scripts/generate_trade_pdf.py) to process data and generate the report. - [EXTERNAL_DOWNLOADS]: The skill attempts to install the
reportlabpackage from the standard Python package registry if it is not already installed on the system. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external files which could potentially contain untrusted content.
- Ingestion points: The skill reads all markdown files in the current directory matching the pattern
TRADE-*.md. - Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious instructions within the trade analysis files.
- Capability inventory: The skill utilizes terminal access for file operations, package installation, and script execution.
- Sanitization: Data is parsed into a structured JSON format before being passed to the PDF generator, providing a layer of structural validation, though text content is not explicitly sanitized.
Audit Metadata