template-engine
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes external data (CSV and templates) which represents a surface for indirect prompt injection. * Ingestion points: Data provided to functions like fill_template and mail_merge in SKILL.md. * Boundary markers: The skill does not implement specific delimiters or warnings to ignore instructions embedded in the data. * Capability inventory: Includes file system read and write operations via docxtpl and openpyxl libraries. * Sanitization: There is no evidence of input validation or sanitization before data is rendered into document templates.
- [SAFE]: The skill relies on well-known and established Python libraries for document processing, such as python-docx, openpyxl, and jinja2.
- [SAFE]: External repository links are directed to official and vendor-related sources.
Audit Metadata