nickel-concentration-risk-analyzer
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from various external web sources, which serves as a potential surface for indirect prompt injection attacks if those external sources are compromised by malicious actors.
- Ingestion points: The script
scripts/ingest_sources.pyand theingestworkflow retrieve information from external URLs, including government agency pages and corporate investor relations sites. - Boundary markers: The instructions lack explicit prompt boundary markers or delimiters for external data ingested into the agent context.
- Capability inventory: The skill includes functions to perform network requests (via
requests) and write files to the localoutput/directory (e.g., JSON results and PNG charts). - Sanitization: The skill incorporates numerical sanity checks in
scripts/compute_concentration.pyto ensure production values remain within historically plausible ranges. - [EXTERNAL_DOWNLOADS]: The skill retrieves data and reports from established government and commercial domains for its primary analysis purposes. These sources are well-known and consistent with the skill's domain of expertise.
- Fetches production statistics from the U.S. Geological Survey (USGS) and International Nickel Study Group (INSG) official websites.
- Retrieves financial and production data from the official investor relations portals of major nickel producers such as Vale, Eramet, and Nickel Industries.
Audit Metadata