procurement-offer-review
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external, potentially untrusted supplier documents in PDF and Docx formats.
- Ingestion points: Supplier offers are read and parsed in the
OFFER-REVIEWmode using tools likepython-docxorpypdf. - Boundary markers: The instructions do not explicitly mandate 'ignore embedded instructions' markers. However, the requirement to produce 'Evidence Cards' with specific ToR references and page locations serves as a structural constraint that limits the influence of arbitrary text within the offers.
- Capability inventory: The agent has the capability to write new files (e.g.,
_COMMENTS.docx), modify existing internal procurement files (PACK-PROPAGATE), and update Excel workbooks (SCORE-COMPARE). - Sanitization: The
PACK-PROPAGATEmode utilizes a 'Sentence-count guard' and 'Verification block' to ensure that automated edits do not unintentionally overwrite or delete unrelated content. - [COMMAND_EXECUTION]: The
references/docx-xlsx-mechanics.mddocumentation instructs the agent to use Windows PowerShell 5.1 (powershell.exe) for Excel COM automation tasks, providing a method for system-level document interaction. - [EXTERNAL_DOWNLOADS]: The skill references the installation and use of standard document processing libraries, including
python-docx,pypdf, andopenpyxl, from official registries.
Audit Metadata