implementation-pack
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Python code using the
ane_packagelibrary to load configurations, process proposal baselines, and generate output files such as implementation trackers and technical reports. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface as it ingests data from untrusted proposal baselines.
- Ingestion points: External proposal data is loaded from files or folders (e.g.,
handback.json) inSKILL.mdat Step 2. - Boundary markers: There are no defined boundary markers or instructions to treat the ingested proposal data as potentially untrusted content.
- Capability inventory: The skill is capable of generating persistent file outputs (Excel and Word documents) and spawning additional reporting skills based on the processed data.
- Sanitization: The instructions do not specify any validation or sanitization steps for the data contained within the proposal baselines before processing.
Audit Metadata