artifact-management
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent or user to execute a local web server using
python3 -m http.server 8000to view generated HTML charts. This command binds the server to all available network interfaces by default, potentially exposing sensitive artifacts to other devices on the same local network if not properly restricted. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and persist external data into files, creating a surface for indirect prompt injection and client-side attacks like XSS.
- Ingestion points: The skill ingests 'original user questions', 'SQL queries', 'result snapshots', and 'metric definitions' from external data sources or user input (SKILL.md).
- Boundary markers: The instructions suggest structural templates but do not define clear delimiters or headers that would prevent the agent from being influenced by instructions embedded within the data being stored.
- Capability inventory: The skill leverages file-writing capabilities to create various file types, including HTML, Markdown, and CSV, in the local workspace.
- Sanitization: While the skill provides prose warnings to avoid 'secrets' and 'sensitive raw rows', it lacks instructions for technical sanitization or escaping of data, particularly when generating 'chart.html', which may be viewed in a browser context.
Audit Metadata