account-intelligence

Warn

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill instructs the agent to write a Node.js script (generate-report.js) using a template and then execute it via the node command. This script dynamically assembles the report and renders charts based on researched data.
  • [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes data from external web searches (e.g., job postings, press releases, and corporate news) which are then interpolated into the report and the generation script.
  • Ingestion points: External research data gathered through Dimensions 1-8, including SAM.gov, USAJobs, and general web search results.
  • Boundary markers: The skill includes a 'Quality Gate' phase and validation rules to ensure data accuracy and source citation, which serves to mitigate accidental misinformation but not necessarily adversarial injection.
  • Capability inventory: The agent is capable of writing files to the local filesystem and executing shell commands to install packages and run Node.js scripts.
  • Sanitization: There is no explicit instruction to sanitize or escape the content retrieved from external searches before it is placed into the dynamically generated script code.
  • [COMMAND_EXECUTION]: The skill uses the command line to create directories, install dependencies, and execute the generated report script.
  • [EXTERNAL_DOWNLOADS]: The skill fetches standard packages from the npm registry, including docx, chart.js, and chartjs-node-canvas.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 9, 2026, 05:39 AM