margin-simulation
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
scripts/margin_engine.pyto perform financial modeling. This execution is scoped to the skill's own logic and uses a structured JSON configuration for input, minimizing the risk of arbitrary command injection. - [SAFE]: No evidence of data exfiltration, credential exposure, or malicious network operations was found. The skill operates entirely on local data and provided references.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data (e.g., client names, project descriptions) to generate a financial report.
- Ingestion points: User-provided inputs for revenue, costs, and project metadata in
SKILL.md. - Boundary markers: Absent; user data is interpolated directly into the generated markdown report without explicit delimiters.
- Capability inventory: Local script execution (
python margin_engine.py) and tool chaining via Visualizer buttons (change-order-generator,fte-capacity-sizing). - Sanitization: No explicit sanitization of user strings is performed before they are used in the simulation config or the final output report.
Audit Metadata