dcf-model
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/recalc.pyutilizessubprocess.runto execute LibreOffice (soffice) in headless mode. This is the primary mechanism for recalculating Excel formulas without manual intervention. The command construction uses a list format which prevents shell injection, and the binary path is resolved via standard system utilities. - [EXTERNAL_DOWNLOADS]: The
SKILL.mdfile contains instructions to installopenpyxlvia pip if it is not already present. This is a standard, well-known Python library for Excel manipulation. It also suggests installing LibreOffice via system package managers (brew/apt) which are trusted sources. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external financial data such as SEC filings and analyst reports.
- Ingestion points: Financial data retrieved via MCP servers or web searches (SKILL.md).
- Boundary markers: Not explicitly defined in the instructions for external data parsing.
- Capability inventory: Subprocess execution for formula recalculation (
scripts/recalc.py) and file reading (scripts/validate_dcf.py). - Sanitization: The skill relies on the agent's ability to extract specific financial metrics into a structured Excel format, which inherently limits the impact of embedded instructions in source documents.
Audit Metadata