skills/wbh604/uzi-skill/lhb-analyzer/Gen Agent Trust Hub

lhb-analyzer

Pass

Audited by Gen Agent Trust Hub on Apr 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONNO_CODE
Full Analysis
  • [COMMAND_EXECUTION]: The skill's documented data flow involves executing a local Python script (scripts/fetch_lhb.py) that takes a user-supplied stock ticker as an argument. This is a standard architectural pattern for data-fetching skills and represents a defined interface for system interaction.
  • [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes data from external financial records. 1. Ingestion points: External market data is retrieved and processed based on the user-provided ticker (SKILL.md). 2. Boundary markers: No specific delimiters or 'ignore' instructions for embedded content are mentioned in the analysis flow. 3. Capability inventory: The skill can execute local scripts and generate formatted markdown reports for the agent to interpret. 4. Sanitization: No sanitization or verification of the external data's content is described in the provided logic.
  • [NO_CODE]: Several core logic components, including scripts/fetch_lhb.py and lib/seat_db.py, are referenced in the documentation but are not included in the skill package. The analysis is performed based on the provided metadata and reference documents.
  • [SAFE]: The author listed in the skill metadata (FloatFu-true) differs from the platform-provided author handle (wbh604). This discrepancy is noted as a minor metadata inconsistency and does not impact the functional safety of the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 28, 2026, 07:37 AM