ab-testing-pricing
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines an interface for processing external session and experiment data. While this creates a data ingestion surface, the implementation logic in the provided snippets mitigates risk through cryptographic hashing. 1. Ingestion points:
sessionIdandexperimentIdare ingested in theassignVariantfunction withinSKILL.md. 2. Boundary markers: The instructions emphasize deterministic hashing as a boundary between session data and variant selection logic. 3. Capability inventory: The associated task descriptions (evals/database-schema-and-deterministic-varian/task.md,evals/conversion-event-tracking-and-variant-id/task.md) mention database access viadb.rawanddb.orders.insertas environmental capabilities for the agent to use. 4. Sanitization: Input data is processed throughcrypto.createHash('sha256')before being used for variant bucketing, which prevents direct injection into downstream logic. - [EXTERNAL_DOWNLOADS]: The skill references established third-party e-commerce applications such as Intelligems, Nelio, and VWO, as well as the statistical tool abtestguide.com. These references are context-appropriate and target well-known services.
Audit Metadata