nickel-concentration-risk-analyzer

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from various external web sources, which serves as a potential surface for indirect prompt injection attacks if those external sources are compromised by malicious actors.
  • Ingestion points: The script scripts/ingest_sources.py and the ingest workflow retrieve information from external URLs, including government agency pages and corporate investor relations sites.
  • Boundary markers: The instructions lack explicit prompt boundary markers or delimiters for external data ingested into the agent context.
  • Capability inventory: The skill includes functions to perform network requests (via requests) and write files to the local output/ directory (e.g., JSON results and PNG charts).
  • Sanitization: The skill incorporates numerical sanity checks in scripts/compute_concentration.py to ensure production values remain within historically plausible ranges.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves data and reports from established government and commercial domains for its primary analysis purposes. These sources are well-known and consistent with the skill's domain of expertise.
  • Fetches production statistics from the U.S. Geological Survey (USGS) and International Nickel Study Group (INSG) official websites.
  • Retrieves financial and production data from the official investor relations portals of major nickel producers such as Vale, Eramet, and Nickel Industries.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 10:33 PM