vendor-management
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external JSON data which could contain malicious instructions designed to influence the agent's behavior. 1. Ingestion points: Data enters through JSON files specified by the --input argument in script execution. 2. Boundary markers: The SKILL.md does not define delimiters or instructions to ignore embedded content in processed data. 3. Capability inventory: The skill utilizes Python scripts to analyze vendor risk and SLA metrics. 4. Sanitization: The scripts incorporate input string values directly into output reports without filtering for natural language instructions.
Audit Metadata