sales-daily-report
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes
python3 scripts/appmate_config.pyandscripts/sales_report.pyto verify API credentials and generate daily performance reports. These actions are legitimate and within the scope of the skill's intended purpose. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes external data from the App Store Connect API and instructs the agent to display the results in the chat. * Ingestion points: External sales report data is fetched via
scripts/sales_report.py. * Boundary markers: The instructions lack explicit delimiters or warnings to the agent regarding potential instructions embedded within the fetched data. * Capability inventory: The agent has command execution capabilities viapython3. * Sanitization: There is no documentation of sanitization or filtering for the external content before it is processed by the agent.
Audit Metadata