theme-detector
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests untrusted data from external sources, specifically JSON and CSV data from Finviz and FMP APIs via
etf_scanner.pyandrepresentative_stock_selector.py, as well as a CSV timeseries hosted on GitHub inuptrend_client.py. - Boundary markers: The instructions and scripts do not implement specific boundary markers or 'ignore embedded instructions' warnings for the data being processed.
- Capability inventory: The skill's capabilities include data aggregation, mathematical scoring, and generating markdown reports. It does not contain arbitrary shell execution or file-write capabilities using the ingested data.
- Sanitization: The skill performs type-checking and numeric parsing (e.g.,
_safe_float,_parse_market_cap) on all incoming data, which mitigates the risk of malicious payload execution. - [EXTERNAL_DOWNLOADS]:
- The skill establishes network connections to download financial data from well-known and established domains including
finviz.com,financialmodelingprep.com, andraw.githubusercontent.com. These downloads are documented as functional requirements and target legitimate, well-known services or author-owned repositories.
Audit Metadata