hk-valuation-analyzer
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill has a potential surface for indirect prompt injection.
- Ingestion points: Untrusted financial data from HKEX, Bloomberg, and Reuters is processed by the skill as described in SKILL.md.
- Boundary markers: The documentation does not specify the use of delimiters or 'ignore instructions' for external data to prevent it from being interpreted as a command.
- Capability inventory: The skill invokes local shell commands to execute 'scripts/valuation_analyzer.py' for data processing and signal generation.
- Sanitization: No sanitization or filtering of the ingested external content is mentioned in the documentation.
- [NO_CODE]: The source code for the primary execution script 'scripts/valuation_analyzer.py' is missing from the provided files, which prevents a full audit of the skill's operational security.
Audit Metadata