real-estate-investment

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from various external sources and user inputs, creating an indirect prompt injection surface.
  • Ingestion points: The skill retrieves market data and property details from multiple external APIs (Census, AirDNA, Mashvisor, ATTOM, Rentcast) as described in references/market-analysis.md. It also processes user-provided financial data for pro forma construction.
  • Boundary markers: While the skill uses structured JSON for script inputs, there are no specific instructions to treat external data as untrusted or to use explicit delimiters to prevent the agent from obeying instructions embedded in the data.
  • Capability inventory: The included Python scripts in the scripts/ directory have the capability to write results to the file system (via the --output flag). Additionally, the skill facilitates network access to third-party APIs.
  • Sanitization: The provided logic focuses on calculation and does not include explicit sanitization or validation of strings retrieved from external APIs before processing.
  • [EXTERNAL_DOWNLOADS]: The skill provides integration patterns for several well-known real estate and government data services.
  • Fetches demographic data from the U.S. Census Bureau's official API.
  • Retrieves real estate market trends and property estimates from services including Redfin, Mashvisor, AirDNA, ATTOM, and Rentcast.
  • These references target well-known and established services related to the skill's primary function.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 02:37 PM