financial-analytics-dashboard
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [NO_CODE]: The skill package is composed entirely of documentation and evaluation benchmarks. No executable scripts, binaries, or active code components are included in the distribution.
- [INDIRECT_PROMPT_INJECTION]: The skill describes architectures for financial dashboards that ingest untrusted data from external sources like Shopify and SQL databases. While the skill is documentation, the resulting tools have an attack surface for indirect injection. 1. Ingestion points: Financial data feeds from e-commerce platforms (Shopify, WooCommerce) and SQL databases (SKILL.md, task.md). 2. Boundary markers: No explicit delimiter or instruction filtering patterns are defined in the architectural guides. 3. Capability inventory: Automated alerting via email/Slack (Zapier, Google Apps Script) and report generation (SKILL.md). 4. Sanitization: Evaluation criteria require SQL safety patterns and division-by-zero prevention (criteria.json).
- [EXTERNAL_DOWNLOADS]: The documentation directs users to install well-known third-party applications and services from official sources, such as the Shopify App Store and official service domains.
- [SAFE]: All external references and methodologies described involve reputable technology platforms and standard business practices.
Audit Metadata