data-analysis
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill contains hardcoded absolute file paths (e.g.,
/Users/zhangmingda/clawd/.venv) which reveal information about the author's local directory structure and username. - [PROMPT_INJECTION]: The skill is designed to process external data from various file formats (CSV, Excel, JSON), creating a surface for indirect prompt injection if the data contains malicious instructions.
- Ingestion points: Data loading operations in
SKILL.md(pd.read_csv,pd.read_excel,pd.read_json). - Boundary markers: Absent; there are no instructions to the agent to ignore or delimit potentially malicious instructions within the data.
- Capability inventory: Local Python execution with capabilities for statistical modeling and file generation (e.g., saving plots as images).
- Sanitization: No data validation or sanitization routines are implemented for the processed file contents.
Audit Metadata