sales-data-extraction-agent
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: The skill package is composed of descriptive markdown and YAML metadata. It does not include any Python scripts, JavaScript files, shell commands, or binary executables.
- [SAFE]: Analysis of the instructions found no evidence of prompt injection, data exfiltration, or obfuscation. The agent's described logic is focused on legitimate data processing tasks.
- [SAFE]: The skill defines a workflow for ingesting untrusted external data (Excel spreadsheets) and interacting with a database (PostgreSQL). This constitutes a potential indirect prompt injection surface, though it is consistent with the skill's primary mission. Evidence: 1. Ingestion points: Excel file directory monitoring (.xlsx, .xls); 2. Boundary markers: Absent; 3. Capability inventory: PostgreSQL bulk insert and filesystem watching; 4. Sanitization: Mentions validation of metrics but lacks explicit sanitization for instructions embedded in data cells.
- [SAFE]: The metadata source URL refers to an external template repository (github.com/msitarzewski/agency-agents), which is a standard reference for skills within the agency framework.
Audit Metadata