survey-crosstab

Pass

Audited by Gen Agent Trust Hub on Mar 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The entry script scripts/crosstab_cli.py automatically installs missing dependencies including pandas, openpyxl, and numpy from the official Python Package Index (PyPI). These are standard, well-known libraries used for data analysis.
  • [COMMAND_EXECUTION]: The skill utilizes subprocess.check_call to execute pip install for dependency management. This is restricted to a hardcoded list of trusted packages during initial setup.
  • [PROMPT_INJECTION]: The skill processes external survey data in XLSX and CSV formats, presenting an indirect prompt injection surface. Maliciously crafted data entries or column headers could attempt to influence the agent's behavior during the analysis phase.
  • Ingestion points: Survey data is ingested in scripts/crosstab_engine.py via the load_data function.
  • Boundary markers: Absent. The agent is not explicitly cautioned to ignore instructions embedded within the survey data.
  • Capability inventory: The skill has access to subprocess execution (for environment setup) and file writing (for exporting reports).
  • Sanitization: No sanitization of cell contents or headers is performed before the data is analyzed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 12, 2026, 12:27 PM