dcf-model
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- External Data Ingestion: The skill retrieves financial information from SEC filings, analyst reports, and web search results. This process is essential for financial modeling but introduces a potential surface for indirect prompt injection if external sources were to contain instructions intended to influence the agent's behavior. (Category 8)
- Ingestion points: SEC filings, analyst reports, and web search results referenced in
SKILL.md. - Boundary markers: The skill focuses on extracting numeric data into structured Excel formulas, which inherently limits instruction following from the source text.
- Capability inventory: File system access (writing Excel files), network operations (web search), and local command execution (
recalc.py,validate_dcf.py). - Sanitization: The skill uses a dedicated validation script (
validate_dcf.py) and a recalculation tool to ensure the integrity of the generated model. - Command Execution & Scripting: The skill utilizes Python scripts to validate model logic and recalculate formulas. Specifically, it executes
scripts/validate_dcf.pyand references arecalc.pyutility provided by the platform's spreadsheet environment. These operations are restricted to the skill's local environment and intended workflow. (Category 4, 10) - Standard Dependencies: The skill identifies
openpyxlandrequestsas dependencies inrequirements.txt. These are well-known, established libraries for spreadsheet management and HTTP communication, respectively. (Category 4)
Audit Metadata