olive-private-fund

Pass

Audited by Gen Agent Trust Hub on Apr 22, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the @oliveam/olive-kit package via npm during the agent setup phase. This is a vendor-provided package associated with the author (oliveam) that contains the necessary CLI and MCP tools for the skill's operation.
  • [DATA_EXFILTRATION]: The skill utilizes specialized MCP tools such as get_product_detail and get_performance_history to access financial information. These data operations are documented, purpose-built for the skill's research domain, and do not involve unauthorized access to user secrets or system files.
  • [PROMPT_INJECTION]: The instructions within SKILL.md focus on structuring financial analysis and do not contain patterns for bypassing safety guidelines or overriding system prompts.
  • [COMMAND_EXECUTION]: The skill references the use of oliveam-mcp and oliveam CLI tools. These tools are used for their intended purpose of providing the MCP environment and managing the skill's data connection.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external fund documents via the search_product_docs tool. Mandatory Evidence: (1) Ingestion points: search_product_docs (SKILL.md); (2) Boundary markers: Absent; (3) Capability inventory: oliveam CLI, MCP tools for search/read (references/tools.md); (4) Sanitization: Absent. The risk is minimized by the context-specific nature of the tool and the absence of high-privilege execution capabilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 22, 2026, 07:22 AM