cfo-finance
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's architecture relies on ingesting untrusted external data, which creates a potential surface for indirect prompt injection attacks.
- Ingestion points: In
SKILL.md, the agent is instructed to accept "Financial statements or raw data exports (CSV, JSON, structured)", "Audit or compliance requests", and "plain-language requests" as primary inputs. - Boundary markers: The skill instructions lack specific delimiters or instructions to ignore instructions embedded within the ingested financial datasets.
- Capability inventory: The skill possesses significant orchestration capabilities, with the authority to commission and pass data to four specialized sub-skills (revenue-operations, accounts-payable, payroll-compensation, and tax-compliance) as defined in the orchestration rules of
SKILL.md. - Sanitization: There is no requirement in the instructions for the agent to validate, sanitize, or escape the content of raw data exports before processing them for financial reporting or task delegation.
Audit Metadata