catalyst-calendar
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources via
WebSearchandWebFetchto identify catalysts (Step 2). - Ingestion points: External websites, regulatory dockets, and news sources accessed via web tools.
- Boundary markers: The instructions explicitly mandate the use of primary source overrides (issuers, regulators) and structured "Event Lenses" for extraction, which helps constrain the AI's interpretation of external content.
- Capability inventory: The skill has the ability to write to files (
calendar.xlsx) and execute a local script (recalc.py). - Sanitization: The skill relies on source verification and strict schema matching (event categories and materiality scoring) rather than programmatic sanitization.
- [COMMAND_EXECUTION]: The skill invokes a local script (
python .agents/skills/xlsx/scripts/recalc.py) to recalculate the generated Excel workbook. This is a legitimate use of internal functionality designed to support the skill's primary purpose of calendar generation.
Audit Metadata