market-research-reports

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied market topics and interpolates them directly into prompts for external schematic and image generation tools, creating a surface for indirect prompt injection.\n
  • Ingestion points: The topic argument in scripts/generate_market_visuals.py and market topic variables in the SKILL.md instructions.\n
  • Boundary markers: Absent; the skill does not use delimiters or instructions to the agent to ignore potentially malicious content embedded in the market topic.\n
  • Capability inventory: The skill utilizes subprocess.run to invoke generation scripts and uses the Bash tool for research and LaTeX compilation.\n
  • Sanitization: Absent; the script uses string formatting to insert user input into pre-defined prompt templates without validation.\n- [COMMAND_EXECUTION]: The script scripts/generate_market_visuals.py uses subprocess.run to automate visual generation by calling other scripts in the environment. While the script correctly passes arguments as a list rather than a shell string, it remains a vector for executing automated commands based on agent-generated or user-supplied content.\n- [COMMAND_EXECUTION]: The skill relies on the Bash tool to perform complex tasks including running research lookups via research_lookup.py, generating multiple visual assets, and compiling 50+ page LaTeX documents using xelatex and bibtex.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 12:15 PM