tufte-critique

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided graphic descriptions, images, or files for evaluation, which serves as an ingestion point for untrusted data.
  • Ingestion points: User-supplied descriptions, images, or files of graphics as defined in the skill workflow.
  • Boundary markers: The skill does not define specific delimiters or instructions to ignore potential instructions embedded within the user data.
  • Capability inventory: The skill is capable of executing a local utility script and generating text-based critiques; it lacks network access or sensitive file system permissions.
  • Sanitization: No explicit sanitization or input validation is specified for the user-provided data.
  • [COMMAND_EXECUTION]: The skill invokes a bundled local script, scripts/deflate.py, to perform currency inflation adjustments for monetary time-series data.
  • Evidence: The SKILL.md file explicitly directs the agent to use this script for multi-year currency series analysis.
  • Evaluation: The script is a local vendor resource authored by 'gnurio'. It performs mathematical operations using standard Python libraries and does not demonstrate malicious patterns or network communication.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 09:20 PM
Security Audit — agent-trust-hub — tufte-critique