create-amazon-reconciliation-dashboard

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DATA_EXFILTRATION]: The skill performs network requests to external API endpoints at api.datadoe.com and app.datadoe.com to retrieve seller account data and export generated reports. This involves transmitting user-specific parameters to a non-whitelisted domain.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data from the DataDoe API to generate a user-facing dashboard, creating a potential surface for indirect prompt injection.
  • Ingestion points: Data is retrieved from the DataDoe API via exports_raw_download or REST fallback endpoints, specifically targeting order line items and settlement components.
  • Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the fetched data.
  • Capability inventory: The agent has the capability to write files (generating the HTML dashboard) and perform network operations via the DataDoe toolset.
  • Sanitization: The implementation logic focuses on data aggregation and reconciliation but does not explicitly require sanitization of strings from the API responses before they are interpolated into the HTML output.
  • [EXTERNAL_DOWNLOADS]: The generated dashboard is configured to download the Chart.js library from a public CDN (https://cdn.jsdelivr.net/npm/chart.js) at runtime.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 05:43 PM