csv-data-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-uploaded data files, creating a surface for potential instruction injection if file content is malicious.
- Ingestion points: The
csv_analyzer.pyscript reads external file content (CSV, Excel, TSV) and generates a textual "Statistical Summary" for the agent to process. - Boundary markers: The script uses clear text separators (e.g.,
====================) and structured markers like###CHART_DATA_JSON_START###to delimit data from instructions. - Capability inventory: The skill can execute Python scripts via
execute_skill_script_fileand generate HTML reports viahtml_interpreter. - Sanitization: While the script converts numerical data to statistics, categorical text labels are passed directly into the summary provided to the agent.
- [EXTERNAL_DOWNLOADS]: The HTML report template (
templates/report_template.html) references external libraries from well-known content delivery networks. - Fetches the Tailwind CSS framework from
cdn.tailwindcss.com. - Fetches the Apache ECharts visualization library from
cdn.jsdelivr.net.
Audit Metadata