Skills
skills/octagonai/skills/sec-10k-analysis/Gen Agent Trust Hub

sec-10k-analysis

Fail

Audited by Gen Agent Trust Hub on Feb 16, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • Remote Code Execution (CRITICAL): The setup instructions in references/mcp-setup.md promote the use of curl | bash for Homebrew installation, which is a high-risk pattern allowing for unverified remote code execution.
  • External Downloads (HIGH): The skill requires the octagon-mcp npm package, which is executed via npx -y without verification of the source or package integrity.
  • Indirect Prompt Injection (MEDIUM): The skill processes data from external websites and SEC filings, creating an attack surface for Category 8. (Evidence: Ingestion: SEC filings/web content; Boundary markers: None; Capabilities: Tool execution and deep research; Sanitization: None mentioned).
  • Command Execution (HIGH): Installation commands for Windows utilize cmd /c to set environment variables and run commands, providing an additional vector for potential exploitation.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
CRITICAL
Analyzed
Feb 16, 2026, 06:05 AM