building-tables

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DATA_EXFILTRATION]: The skill includes a utility script scripts/export_table_data.py that is designed to perform network requests using the requests library to fetch data from remote API endpoints provided as command-line arguments.
  • [INDIRECT_PROMPT_INJECTION]: The skill contains a surface for the ingestion of untrusted data from external network sources which presents a potential vulnerability for indirect prompt injection.
  • Ingestion points: The scripts/export_table_data.py utility fetches data from external URLs via the --api-url parameter.
  • Boundary markers: The implementation lacks delimiters or explicit instructions to the agent to ignore potentially malicious instructions embedded within the retrieved data payloads.
  • Capability inventory: The skill environment supports network fetching (requests) and file system writes (csv, json, pandas).
  • Sanitization: No structural validation or content sanitization is performed on the incoming JSON data before it is formatted and written to the local disk.
  • [COMMAND_EXECUTION]: The documentation explicitly instructs the agent and the user to execute multiple local Python and Node.js scripts (generate_mock_data.py, analyze_performance.js, export_table_data.py, and validate_accessibility.js) to perform maintenance and data processing tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 09:05 AM
Security Audit — agent-trust-hub — building-tables