cohort-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied CSV files and interpolates the data into HTML reports and visualizations.
- Ingestion points: CSV data is read through the
fileargument inscripts/main.py's commands. - Boundary markers: No explicit delimiters or instructions are used to separate user data from the analysis logic.
- Capability inventory: The skill has file writing capabilities for local CSV and HTML output, but lacks network access or dynamic code execution capabilities.
- Sanitization: The skill interpolates CSV values directly into HTML strings in the
generate_heatmap_htmlandgenerate_report_htmlfunctions. While this creates a theoretical injection surface if a user processes a malicious CSV, it is consistent with the skill's primary purpose of data visualization.
Audit Metadata