competitive-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill manages its environment by installing the
python-pptxpackage from the official Python Package Index (PyPI) if it is not already present.\n- [COMMAND_EXECUTION]: A shell command is executed during the preflight check inSKILL.mdto verify the environment and install necessary dependencies.\n- [DYNAMIC_EXECUTION]: Employs a Python one-liner in a shell command to check for module availability and manage library installation at runtime.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external user-provided spreadsheets, creating a potential vector for indirect prompt injection.\n - Ingestion points: Phase 1 of the analysis workflow in
SKILL.mddescribes extracting metrics and competitor data from uploaded Excel or CSV files.\n - Boundary markers: The instructions do not define delimiters or specific guidance to prevent the agent from executing instructions that may be hidden within the data files.\n
- Capability inventory: The skill has access to shell commands for environment setup and performs file-writing operations for deck generation.\n
- Sanitization: No validation or sanitization processes are specified for the data retrieved from external sources.
Audit Metadata