financial-statement-analyzer
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to manage its environment and perform data-gathering tasks, including
python -m pip installfor dependencies andpython ../findata-toolkit-cn/scripts/views_runner.pyfor data retrieval. - [EXTERNAL_DOWNLOADS]: The skill references and installs dependencies from a local sibling directory (
../findata-toolkit-cn/) to enable its financial data fetching capabilities. - [PROMPT_INJECTION]: The agent is instructed to adopt the persona of a 'forensic financial analyst'. This is a task-specific behavioral instruction. Additionally, the skill processes external financial data which represents a surface for indirect prompt injection. 1. Ingestion points: Financial reports and indicators fetched via
views_runner.pyfrom providers like Sina Finance and East Money. 2. Boundary markers: No specific delimiters are implemented in the prompt templates. 3. Capability inventory: Ability to execute local Python scripts. 4. Sanitization: No explicit sanitization of fetched data is described before inclusion in analysis reports.
Audit Metadata