bid-proposal-writer
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlcommands to manage files and trigger tasks on a secondary service. This behavior is transparently documented and serves the primary function of the skill. - [EXTERNAL_DOWNLOADS]: The skill communicates with an external endpoint (
http://opencode-bridge:8000). This service name suggests it is an internal or infrastructure-specific component used for processing user-uploaded documents. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external documents (RFP/bid materials).
- Ingestion points: Files uploaded by the user to the
input/directory, which are then read and sent to the bridge service. - Boundary markers: None provided in the instruction templates; the agent is instructed to process the documents directly.
- Capability inventory: File reading (
input/), network communication viacurl, and file writing to theoutput/directory. - Sanitization: There are no explicit instructions for the agent to sanitize or ignore embedded instructions within the processed documents.
Audit Metadata