sales-reporting-dashboard
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides instructional content for setting up sales dashboards on platforms like Shopify, WooCommerce, and BigCommerce. It references well-known and trusted services such as Google Looker Studio for custom reporting.- [INDIRECT_PROMPT_INJECTION]: The skill describes building an analytics API that ingests external parameters (date ranges, granularity) and processes store data (orders, sessions). This creates a potential surface for indirect prompt injection if source data (e.g., product names or customer fields) contains malicious instructions. However, the skill includes criteria for proper input validation and safe SQL practices.
- Ingestion points: API query parameters (
start,end,granularity) and database tables (orders,sessions,products) mentioned inevals/revenue-api-with-caching-and-granularity/task.mdandSKILL.md. - Boundary markers: The evaluation criteria in
evals/conversion-rate-and-period-over-period-c/criteria.jsonencourage the use of named parameters (e.g.,:start_date) rather than string interpolation. - Capability inventory: Database querying (
db.query) and Redis caching are the primary capabilities identified across the task files. - Sanitization: The
criteria.jsonfiles specify mandatory validation for parameters like granularity and use ofNULLIFfor mathematical safety.
Audit Metadata