survey-crosstab
Pass
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The entry script
scripts/crosstab_cli.pyautomatically installs missing dependencies includingpandas,openpyxl, andnumpyfrom the official Python Package Index (PyPI). These are standard, well-known libraries used for data analysis. - [COMMAND_EXECUTION]: The skill utilizes
subprocess.check_callto executepip installfor dependency management. This is restricted to a hardcoded list of trusted packages during initial setup. - [PROMPT_INJECTION]: The skill processes external survey data in XLSX and CSV formats, presenting an indirect prompt injection surface. Maliciously crafted data entries or column headers could attempt to influence the agent's behavior during the analysis phase.
- Ingestion points: Survey data is ingested in
scripts/crosstab_engine.pyvia theload_datafunction. - Boundary markers: Absent. The agent is not explicitly cautioned to ignore instructions embedded within the survey data.
- Capability inventory: The skill has access to subprocess execution (for environment setup) and file writing (for exporting reports).
- Sanitization: No sanitization of cell contents or headers is performed before the data is analyzed by the agent.
Audit Metadata