theme-detector

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill ingests untrusted data from external sources, specifically JSON and CSV data from Finviz and FMP APIs via etf_scanner.py and representative_stock_selector.py, as well as a CSV timeseries hosted on GitHub in uptrend_client.py.
  • Boundary markers: The instructions and scripts do not implement specific boundary markers or 'ignore embedded instructions' warnings for the data being processed.
  • Capability inventory: The skill's capabilities include data aggregation, mathematical scoring, and generating markdown reports. It does not contain arbitrary shell execution or file-write capabilities using the ingested data.
  • Sanitization: The skill performs type-checking and numeric parsing (e.g., _safe_float, _parse_market_cap) on all incoming data, which mitigates the risk of malicious payload execution.
  • [EXTERNAL_DOWNLOADS]:
  • The skill establishes network connections to download financial data from well-known and established domains including finviz.com, financialmodelingprep.com, and raw.githubusercontent.com. These downloads are documented as functional requirements and target legitimate, well-known services or author-owned repositories.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 07:41 PM
Security Audit — agent-trust-hub — theme-detector