rfp-submission
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
scripts/rfp_analyzer.pyto classify RFP documents and generate response outlines. The script utilizes only standard library modules (json, sys, argparse, dataclasses, datetime) and performs logic-based tasks without dangerous system calls or external network requests. - [EXTERNAL_DOWNLOADS]: The skill uses web search capabilities to retrieve market data, category penetration, and competitive share from reputable industry sources such as Kantar, Nielsen, and Statista. These operations are conducted within the scope of the agent's research tools.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted RFP documents provided by the user, which presents a surface for indirect prompt injection if those documents contain malicious instructions.
- Ingestion points: RFP document upload (PDF, DOCX, or text) in
SKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the prompt instructions.
- Capability inventory: The skill has access to web search, file generation (PPTX), Google Drive (for templates), and chains to tactical media planning skills.
- Sanitization: The
rfp_analyzer.pyscript performs structural classification but does not sanitize content against prompt injection attacks.
Audit Metadata