qbr-generator

Pass

Audited by Gen Agent Trust Hub on Jun 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Python script (scripts/qbr_builder.py) to perform plan-vs-actual comparisons and scorecard calculations using standard libraries.
  • [EXTERNAL_DOWNLOADS]: The skill performs web searches for industry and market benchmarks (e.g., Kantar, Nielsen) to provide business context for the report.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is a synthesis skill that ingests data from multiple sources. • Ingestion points: Data is pulled from 15 upstream skills, Statement of Work (SOW) targets, and CRM data. • Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present for the interpolated data. • Capability inventory: The skill can execute local scripts, perform web searches, and use platform tools for PPTX, Excel, and Word generation. • Sanitization: No sanitization or validation of the ingested external content is mentioned in the logic or scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 14, 2026, 01:02 AM