vendor-risk-assessment
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFENO_CODEPROMPT_INJECTION
Full Analysis
- [NO_CODE]: The skill consists entirely of descriptive instructions and assessment templates. It does not include any executable scripts, binaries, or configurations for external code execution.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by interpolating user-provided configuration values into the output report.
- Ingestion points: Untrusted data enters the context through
config_fields(e.g.,vendor_name) and user responses during the workflow phases inSKILL.md. - Boundary markers: The template does not utilize explicit delimiters or 'ignore' instructions to isolate interpolated data from agent instructions.
- Capability inventory: The skill possesses no capabilities for subprocess execution, file system writes, or network operations, significantly limiting the impact of any potential injection.
- Sanitization: No input validation or escaping mechanisms are present for the user-supplied fields.
Audit Metadata