mental-health-analyzer
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates entirely on local health data stored in the
data-example/directory and does not contain any hardcoded credentials, unauthorized network calls, or exfiltration patterns. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted daily mood logs, which serves as an ingestion point for potentially malicious instructions hidden in data.
- Ingestion points: Reads daily entries from
data-example/mental-health-logs/YYYY-MM/YYYY-MM-DD.json. - Boundary markers: Absent; the instructions do not specify the use of delimiters or warnings to ignore embedded content during the reading phase.
- Capability inventory:
Read,Grep,Glob,Write, andEdittools are permitted, which allows for file system modification. - Sanitization: Absent; the skill does not explicitly mention filtering or validating log content before processing.
- [DYNAMIC_EXECUTION]: The skill generates interactive HTML reports that include JavaScript (ECharts). This represents dynamic code generation using input from user-provided logs. While no malicious logic is present, this pattern requires the platform or agent to sanitize input to prevent client-side scripting vulnerabilities like XSS when the user views the output.
Audit Metadata