alterlab-grant-reporting
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided academic data such as progress notes, publications, and budget figures to generate report drafts.
- Ingestion points: Processes external grant progress notes, publication lists, and financial records provided in the user prompt (SKILL.md).
- Boundary markers: While no specific prompt delimiters are defined, the instructions strictly guide the agent to follow funder-prescribed structures and headings.
- Capability inventory: The skill possesses file writing/editing capabilities and the ability to execute a local Python script (
scripts/report_deadlines.py) via the Bash tool. - Sanitization: The skill mandates the use of
[TODO]placeholders for any missing information and explicitly instructs the agent never to fabricate figures, dates, or results. - [COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local helper script (
scripts/report_deadlines.py). - Evidence: The script performs deterministic date arithmetic using only the Python standard library (argparse, datetime, json).
- Safety: Analysis of the script confirms it performs no network operations, accesses no sensitive files, and contains no dynamic execution (eval/exec) patterns.
Audit Metadata