account-intelligence
Warn
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructs the agent to write a Node.js script (
generate-report.js) using a template and then execute it via thenodecommand. This script dynamically assembles the report and renders charts based on researched data. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes data from external web searches (e.g., job postings, press releases, and corporate news) which are then interpolated into the report and the generation script.
- Ingestion points: External research data gathered through Dimensions 1-8, including SAM.gov, USAJobs, and general web search results.
- Boundary markers: The skill includes a 'Quality Gate' phase and validation rules to ensure data accuracy and source citation, which serves to mitigate accidental misinformation but not necessarily adversarial injection.
- Capability inventory: The agent is capable of writing files to the local filesystem and executing shell commands to install packages and run Node.js scripts.
- Sanitization: There is no explicit instruction to sanitize or escape the content retrieved from external searches before it is placed into the dynamically generated script code.
- [COMMAND_EXECUTION]: The skill uses the command line to create directories, install dependencies, and execute the generated report script.
- [EXTERNAL_DOWNLOADS]: The skill fetches standard packages from the npm registry, including
docx,chart.js, andchartjs-node-canvas.
Audit Metadata