growth-outlook
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local script
scripts/growth_decomp.pyto perform growth calculations based on revenue and volume metrics. This is a core, expected functionality.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data (financial figures) which is interpolated into shell commands. The lack of explicit boundary markers or sanitization guidelines for the agent creates a potential injection surface where malformed input could influence command execution.\n - Ingestion points: Revenue figures and growth rates provided by users as described in
SKILL.md.\n - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are used when processing input data.\n
- Capability inventory: Shell execution of the local Python script, which includes a file-write capability via the
--outargument.\n - Sanitization: No input validation, escaping, or filtering instructions are provided to the agent to secure the data before interpolation.
Audit Metadata