Supply Chain Strategist
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external datasets such as inventory dataframes and supplier profiles. While this creates a potential attack surface for indirect prompt injection if the source data is untrusted, the provided Python logic is focused on numerical analysis and reporting, which limits the impact of such an attack.
- [COMMAND_EXECUTION]: The skill includes Python code snippets for calculating Economic Order Quantity (EOQ), safety stock, and reorder points. These snippets rely on well-known scientific libraries (numpy and scipy) to perform their intended function. The code is static and does not involve risky operations like shell execution or network requests.
- [EXTERNAL_DOWNLOADS]: The skill references several well-known and legitimate Chinese enterprise platforms (e.g., 1688, Alibaba, Made-in-China, QiChaCha) and global inspection services (SGS, TUV). These are standard industry references and do not represent a security risk.
Audit Metadata