income-statement-growth
Warn
Audited by Snyk on Feb 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). This skill invokes Octagon MCP tools (notably octagon-scraper-agent and octagon-deep-research-agent) to fetch and aggregate data from public financial websites, SEC filings, earnings call transcripts and other external sources, so the agent will ingest and interpret untrusted third‑party content.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). This skill invokes the octagon-mcp tool at runtime via npx (which pulls and executes remote package code) — e.g. https://github.com/OctagonAI/octagon-mcp — and that external package provides the octagon-agent tools which directly influence agent prompts and behavior.
Audit Metadata