emu-bulk-upload
Pass
Audited by Gen Agent Trust Hub on Apr 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill is designed to generate a temporary Python script (
/tmp/emu_transform.py) on the fly to perform data mapping and transformation between user-supplied columns and the Emu template, which is then executed by the agent. - [COMMAND_EXECUTION]: The workflow involves executing multiple pre-shipped Python utility scripts (e.g.,
scripts/match_sites.py,scripts/parse_emu_export.py) via the shell to perform heavy data processing and database record matching. - [EXTERNAL_DOWNLOADS]: The skill links to and fetches visual aid screenshots from the author's GitHub repository (
github.com/brunoasm/my_claude_skills) to assist users with manual export steps. - [PROMPT_INJECTION]: The skill processes untrusted tabular data (XLSX, CSV, TSV) from users in Step 1. While there are no explicit boundary markers or sanitization steps documented for this ingestion, the data is primarily used as input for deterministic scripts rather than direct interpolation into system-level instructions, resulting in a low risk of indirect prompt injection.
Audit Metadata