cvp-breakeven
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests untrusted data from user prompts and CSV files to perform financial modeling without implementing defensive measures.
- Ingestion points: Data entering through user interactions defined in SKILL.md and CSV file reading mentioned in EXAMPLE.md.
- Boundary markers: The instructions lack delimiters or safety warnings to ignore instructions embedded within the data.
- Capability inventory: The skill utilizes subprocess execution of 'scripts/calculate.py' and suggests performing regression analysis via code.
- Sanitization: There is no evidence of input validation or sanitization for the provided financial figures or file content.
- [COMMAND_EXECUTION]: The skill instructs the agent to run 'scripts/calculate.py' for accurate computations and encourages using code-based regression for cost analysis. These operations occur within the local execution environment.
Audit Metadata