donor-proposal-scoring
Warn
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documentation in
references/word-export.mdcontains Python code that performs dynamic path manipulation usingsys.path.insertto load modules from a hardcoded local Windows directory.\n- [REMOTE_CODE_EXECUTION]: The skill automates the creation and execution of local Python scripts (e.g.,gen_<slug>_docx.py) to handle Word document exports, representing a dynamic execution pattern.\n- [COMMAND_EXECUTION]: The instructions require the agent to run shell commands for managing git repositories and executing generated Python scripts.\n- [EXTERNAL_DOWNLOADS]: The skill depends on a non-standard local custom library (ane_package) stored at absolute system paths, which creates a dependency on an unverified and uncontrolled local environment.\n- [DATA_EXFILTRATION]: Multiple files contain hardcoded absolute Windows file paths (e.g.,C:\\Users\\AGasser\\OneDrive\\...) that expose sensitive system information, including the local username and internal project directory structures.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection.\n - Ingestion points: The skill reads and processes external donor call documents and grant proposals (SKILL.md Step 1 and 2).\n
- Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the ingested proposal text.\n
- Capability inventory: The skill has capabilities to write files, perform git commits, and execute local Python scripts.\n
- Sanitization: There is no evidence of sanitization or escaping of the external content before it is processed or used in script generation.
Audit Metadata