tufte-critique
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided graphic descriptions, images, or files for evaluation, which serves as an ingestion point for untrusted data.
- Ingestion points: User-supplied descriptions, images, or files of graphics as defined in the skill workflow.
- Boundary markers: The skill does not define specific delimiters or instructions to ignore potential instructions embedded within the user data.
- Capability inventory: The skill is capable of executing a local utility script and generating text-based critiques; it lacks network access or sensitive file system permissions.
- Sanitization: No explicit sanitization or input validation is specified for the user-provided data.
- [COMMAND_EXECUTION]: The skill invokes a bundled local script,
scripts/deflate.py, to perform currency inflation adjustments for monetary time-series data. - Evidence: The
SKILL.mdfile explicitly directs the agent to use this script for multi-year currency series analysis. - Evaluation: The script is a local vendor resource authored by 'gnurio'. It performs mathematical operations using standard Python libraries and does not demonstrate malicious patterns or network communication.
Audit Metadata