accreditation-desk-review
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows professional software development practices, including the use of content-based cell location to prevent data corruption caused by Microsoft Word's automatic table merging.
- [SAFE]: The bundled script
scripts/deskreview.pyimplements defensive coding by checking for file locks before attempting write operations and creating timestamped backups for all modified documents. - [PROMPT_INJECTION]: The skill processes external data from Member Association evidence files (.pdf, .docx, .xlsx), which represents an indirect prompt injection surface. This is effectively mitigated by structured boundary markers (prefixed 'REVIEWER CONCLUSIONS:' blocks) and a mandatory protocol that treats unreadable content as data gaps rather than allowing fabrication.
- [SAFE]: External dependencies are limited to well-known, legitimate libraries (
python-docx,pypdf,openpyxl) required for the skill's primary function. - [SAFE]: File system operations are localized and include filename sanitization in the
cmd_extractfunction to prevent path traversal issues.
Audit Metadata