rq-morning-note
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/generate_report.pyinvokes a report renderer usingsubprocess.runwith list-based arguments. This approach is used to generate HTML versions of the report from Markdown and is implemented to prevent shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill depends on the
rqdataCLI utility for retrieving market data. This is a legitimate dependency belonging to the skill's authoring organization. - [DATA_EXPOSURE]: The skill processes structured financial data and writes reports to local directories. It does not access sensitive user files or perform unauthorized network communications.
- [SAFE]: The skill handles potentially untrusted data from web search results via
web_search_findings.json. It implements validation logic invalidate_web_search_recordsto ensure data integrity before interpolation. Ingestion points:web_search_findings.json. Boundary markers: Markdown section headers. Capability inventory: subprocess calls for rendering. Sanitization: Validation of structured fields and whitespace normalization. - [PROMPT_INJECTION]: Instructions within
SKILL.mdare focused on report formatting and data accuracy. There are no patterns suggesting attempts to bypass AI safety constraints.
Audit Metadata