create-amazon-reconciliation-dashboard
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill performs network requests to external API endpoints at
api.datadoe.comandapp.datadoe.comto retrieve seller account data and export generated reports. This involves transmitting user-specific parameters to a non-whitelisted domain. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data from the DataDoe API to generate a user-facing dashboard, creating a potential surface for indirect prompt injection.
- Ingestion points: Data is retrieved from the DataDoe API via
exports_raw_downloador REST fallback endpoints, specifically targeting order line items and settlement components. - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the fetched data.
- Capability inventory: The agent has the capability to write files (generating the HTML dashboard) and perform network operations via the DataDoe toolset.
- Sanitization: The implementation logic focuses on data aggregation and reconciliation but does not explicitly require sanitization of strings from the API responses before they are interpolated into the HTML output.
- [EXTERNAL_DOWNLOADS]: The generated dashboard is configured to download the Chart.js library from a public CDN (
https://cdn.jsdelivr.net/npm/chart.js) at runtime.
Audit Metadata