benchmark-due-diligence
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
WebSearchandWebFetchtools to gather information from external websites and social platforms during its data collection phases. - [COMMAND_EXECUTION]: The orchestration logic invokes specialized CLI tools such as
agent-reach(for social platform data) andqcc(for corporate registration data) via shell commands. - [PROMPT_INJECTION]: The skill is subject to indirect prompt injection as it processes data from untrusted external sources. This risk is addressed by utilizing adversarial 'Verification' agents and enforcing strict JSON schema validation on all gathered content to prevent instructions from influencing agent behavior.
- [SAFE_PRACTICE]: The skill implements an explicit 'two-channel' data handling policy. It ensures that 'COMMISSIONER_CONTEXT' (private strategic data) is only provided to the final synthesis agent, which does not perform external network operations, effectively preventing privacy leaks through search queries.
Audit Metadata