bagisto-data-transfer
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill facilitates the ingestion of external data files (CSV, XLSX, XML), which creates a surface for indirect prompt injection where malicious instructions could be embedded within the data rows.
- Ingestion points: External data enters the context through the
Helpers\Sources\classes inSKILL.mdwhich iterate over various file formats. - Boundary markers: The skill mandates the implementation of a
validateRow()method and a$validColumnNamesproperty (documented inimporters.md) to enforce schema constraints. - Capability inventory: The skill uses database repositories for writing data and dispatches queued jobs (
ImportBatch,LinkBatch,IndexBatch) as described inpipeline.md. - Sanitization: The instructions in
importers.mdrecommend using Laravel'sValidatorto verify data types and constraints. - [EXTERNAL_DOWNLOADS]: The pipeline includes a specific state for downloading product images from remote sources, including external URLs (
IMAGE_SOURCE_URL). This results in the system performing network requests to retrieve assets based on the contents of the import file.
Audit Metadata