supply-chain
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill presents a surface for Indirect Prompt Injection (Category 8) as it processes untrusted data from external sources.\n
- Ingestion points: External data enters the context via
WebSearchandsearch_documentstools during the identification of suppliers and customers.\n - Boundary markers: The instructions do not specify the use of boundary markers or instructions for the agent to ignore embedded commands in the untrusted data being processed.\n
- Capability inventory: The skill has file-write capabilities (saving HTML reports) and the ability to launch the
opentool to render the file in a browser.\n - Sanitization: The skill explicitly mandates the use of
textContentandcreateElement()for all DOM operations, which significantly reduces the risk of malicious scripts being executed in the user's browser, even if the LLM's logic is influenced by external data.\n- [COMMAND_EXECUTION]: The skill automatically invokes theopentool on its generated report file, which leads to the immediate rendering of content derived from external sources. While this is a standard workflow for report generation, it bypasses user review of the file contents before execution.
Audit Metadata