tech-earnings-deepdive
Pass
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: SAFENO_CODEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [NO_CODE]: The skill is entirely composed of markdown-based instructions and configuration logic across the primary SKILL.md and secondary reference files. It does not contain executable Python scripts, Node.js code, or binary executables.
- [EXTERNAL_DOWNLOADS]: The README.md file provides installation instructions using a URL directed to an official GitHub repository. This is a standard and expected method for skill distribution on the target platform.
- [PROMPT_INJECTION]: The skill architecture is designed to ingest and interpret untrusted external data such as SEC filings, news reports, and earnings call transcripts (Modules A-P). This creates a potential surface for indirect prompt injection. \n
- Ingestion points: Technical analysis modules (A-P) that read SEC 10-K/10-Q filings, news analysis, and CEO quotes. \n
- Boundary markers: The skill does not define explicit delimiters or instructions to ignore potential commands embedded within the processed financial text. \n
- Capability inventory: The skill is limited to generating analytical reports and investment memos; it lacks capabilities for file system modification, network exfiltration, or code execution. \n
- Sanitization: No specific filtering or sanitization protocols for external data inputs are documented in the prompting logic.
Audit Metadata