sales-reporting-dashboard

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill provides instructional content for setting up sales dashboards on platforms like Shopify, WooCommerce, and BigCommerce. It references well-known and trusted services such as Google Looker Studio for custom reporting.- [INDIRECT_PROMPT_INJECTION]: The skill describes building an analytics API that ingests external parameters (date ranges, granularity) and processes store data (orders, sessions). This creates a potential surface for indirect prompt injection if source data (e.g., product names or customer fields) contains malicious instructions. However, the skill includes criteria for proper input validation and safe SQL practices.
  • Ingestion points: API query parameters (start, end, granularity) and database tables (orders, sessions, products) mentioned in evals/revenue-api-with-caching-and-granularity/task.md and SKILL.md.
  • Boundary markers: The evaluation criteria in evals/conversion-rate-and-period-over-period-c/criteria.json encourage the use of named parameters (e.g., :start_date) rather than string interpolation.
  • Capability inventory: Database querying (db.query) and Redis caching are the primary capabilities identified across the task files.
  • Sanitization: The criteria.json files specify mandatory validation for parameters like granularity and use of NULLIF for mathematical safety.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 11:01 AM