performance-reporting

Pass

Audited by Gen Agent Trust Hub on Mar 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [SAFE]: The skill provides legitimate financial tools and computational scripts with no evidence of malicious instructions, privilege escalation, or persistence mechanisms.
  • [EXTERNAL_DOWNLOADS]: Dependencies on standard scientific libraries numpy and scipy are established and appropriate for the skill's analytical purpose.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to run scripts/performance_reporting.py, which is a standard method for executing local analytical scripts.
  • [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes external portfolio data and labels. However, the risk is minimal due to the numerical focus and input validation.
  • Ingestion points: External data is passed to calculation classes in scripts/performance_reporting.py as numerical arrays.
  • Boundary markers: No specific delimiters are used in the provided markdown instructions for data ingestion.
  • Capability inventory: The skill uses Bash, Read, Write, and Edit tools.
  • Sanitization: Numerical inputs are sanitized through explicit conversion to np.float64 within the script's constructors.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 19, 2026, 11:45 PM