fpga-engineering

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from a CSV file (input.csv) using the fpga_engineering_diagnostics.py script and then incorporates that summary into the agent's context. This creates a surface where instructions hidden within the data fields (e.g., in a pipeline_stage string) could attempt to influence downstream agent actions.
  • Ingestion points: Data is read from input.csv in scripts/fpga_engineering_diagnostics.py and then printed/saved as JSON to be used by the agent.
  • Boundary markers: None identified; the JSON output is processed directly by the agent without specific delimiters or instructions to ignore embedded commands.
  • Capability inventory: The skill uses Python scripts with pandas for data processing and writes to the local file system (--output).
  • Sanitization: The script performs type conversion and drops rows with invalid timestamps, but it does not sanitize string content against potential prompt injection attacks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 08:45 AM
Security Audit — agent-trust-hub — fpga-engineering