raffle-winner-picker
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructions for a legitimate use case: selecting contest winners. It does not include any executable scripts, commands, or network requests to untrusted domains.
- [PROMPT_INJECTION]: The skill is designed to ingest data from external sources like Google Sheets and CSV files. This represents a potential surface for indirect prompt injection if the ingested data contains malicious instructions. However, the skill lacks high-risk capabilities (like system command execution or network exfiltration) that would allow for an exploit.
- Ingestion points: SKILL.md describes reading from Google Sheets URLs and local files like 'entries.csv'.
- Boundary markers: None explicitly defined in the instructions.
- Capability inventory: File reading and Google Sheets access only.
- Sanitization: None described.
Audit Metadata