calc-sample-size
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses provided templates to generate R code and is instructed to execute it using the
Bashtool to provide results. This capability for runtime script generation and execution represents a dynamic execution surface, though it is used here for standard mathematical computations. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied parameters (e.g., prevalence, expected means, effect sizes) for interpolation into code blocks and IRB justification text. This ingestion of untrusted data into prompt templates is an identified attack surface.
- Ingestion points: User-provided inputs for the 17 statistical tests described in SKILL.md and Phase 2 of the workflow.
- Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the user-supplied data within the templates.
- Capability inventory: The skill uses Read, Write, Edit, and Bash tools as defined in the skill metadata and SKILL.md instructions.
- Sanitization: There are no explicit instructions to validate, filter, or escape user-supplied statistical parameters before interpolation.
Audit Metadata