market-research
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user-provided JSON files which are processed by scripts to generate market research reports.\n
- Ingestion points: Data enters the agent's context through the
--inputflag intam_sam_som_builder.py,demand_signal_triangulator.py, andsurvey_instrument_auditor.pyas described in theSKILL.mdworkflows.\n - Boundary markers: The skill relies on structured JSON formatting for input data, though it lacks explicit "ignore embedded instructions" markers when the agent interprets the resulting script output.\n
- Capability inventory: The scripts are restricted to mathematical computation and regex-based auditing. They contain no subprocess calls, network operations, or dynamic code execution (
eval/exec).\n - Sanitization: Inputs are validated for correct JSON structure and expected value ranges (e.g., probability ratios between 0 and 1) within the Python script logic.\n- [SAFE]: No malicious patterns, unauthorized network access, or sensitive data exposure were detected in the skill's instructions or scripts. The Python tools use only standard library modules and perform deterministic operations.
Audit Metadata