finance-close-checklist
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [NO_CODE]: The skill consists entirely of markdown-based procedures and metadata. It does not include any executable scripts, shell commands, or external code dependencies.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external financial data such as sub-ledger records and accrual schedules. This represents a potential indirect prompt injection surface if the source files contain malicious instructions.
- Ingestion points: The
Inputssection ofSKILL.mdidentifies various financial data sources as processing targets. - Boundary markers: The skill contains a dedicated
Input Sanitizationsection that explicitly treats inputs as read-only artifacts. - Capability inventory: The skill facilitates orchestration and hand-offs to other finance-related skills but lacks direct command execution or network capabilities.
- Sanitization: The instructions mandate validation of entity codes and account numbers against master records (COA and entity master) before use.
Audit Metadata