rq-morning-note

Pass

Audited by Gen Agent Trust Hub on Apr 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/generate_report.py invokes a report renderer using subprocess.run with list-based arguments. This approach is used to generate HTML versions of the report from Markdown and is implemented to prevent shell injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The skill depends on the rqdata CLI utility for retrieving market data. This is a legitimate dependency belonging to the skill's authoring organization.
  • [DATA_EXPOSURE]: The skill processes structured financial data and writes reports to local directories. It does not access sensitive user files or perform unauthorized network communications.
  • [SAFE]: The skill handles potentially untrusted data from web search results via web_search_findings.json. It implements validation logic in validate_web_search_records to ensure data integrity before interpolation. Ingestion points: web_search_findings.json. Boundary markers: Markdown section headers. Capability inventory: subprocess calls for rendering. Sanitization: Validation of structured fields and whitespace normalization.
  • [PROMPT_INJECTION]: Instructions within SKILL.md are focused on report formatting and data accuracy. There are no patterns suggesting attempts to bypass AI safety constraints.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 27, 2026, 06:12 AM