byted-data-deepresearch-structured2markdown
Fail
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: HIGHPRIVILEGE_ESCALATIONCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill instructs the agent to perform system-level package installation using
apt update && apt install python3-venv -yif the environment setup fails, which requires root or sudo privileges.\n- [CREDENTIALS_UNSAFE]: The skill handles Volcengine AccessKey and SecretKey by prompting the user for them and instructing the agent to "remember" the values, leading to the potential persistence and exposure of long-lived credentials within the conversation context.\n- [COMMAND_EXECUTION]: The skill uses shell commands to search the home directory (find ~ -maxdepth 8) to locate its scripts and manages a Python virtual environment through command line operations.\n- [EXTERNAL_DOWNLOADS]: The skill automatically downloads and installs packages from external registries during its environment setup phase.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied Excel and CSV files which may contain malicious instructions.\n - Ingestion points: Data files read by the
data2md.pyscript via the--filesargument.\n - Boundary markers: No delimiters or instructions to ignore embedded commands are present in the processing logic.\n
- Capability inventory: The skill can perform network operations to the Volcengine API and write files to the local file system.\n
- Sanitization: Content from the spreadsheet files is processed and sent to the API without explicit sanitization or filtering.\n- [PROMPT_INJECTION]: The skill mandates a "highest priority" output rule that forbids the agent from displaying technical steps, status updates, or internal information like paths and tokens to the user, overriding standard transparency and auditing protocols.
Recommendations
- AI detected serious security threats
Audit Metadata