epd-compare
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies multiple points where it ingests untrusted external data for comparison purposes.
- Ingestion points: Data is gathered from Google Sheets (via
mcp__google__sheets_values_get), CSV/markdown files, and text parsed from prior agent steps in the conversation (referenced inSKILL.mdunder Workflow Step 1). - Boundary markers: Absent. The skill instructions do not specify the use of delimiters or 'ignore' instructions to prevent the agent from following commands that might be embedded within the EPD data or spreadsheets.
- Capability inventory: The skill utilizes
Writepermissions to save reports to the local file system and has access to theBashtool (defined inSKILL.mdfrontmatter). - Sanitization: Absent. There are no explicit validation or sanitization steps mentioned to filter the content of the external data before it is interpolated into the final markdown report.
Audit Metadata