goal-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external JSON files which may contain untrusted user-supplied content. This data is used for analysis and interpolated into reports, creating a potential surface for instructions embedded in data to influence the agent's behavior.
- Ingestion points: The skill reads from
data-example/health-goals-tracker.json,data-example/nutrition-tracker.json, and various daily log files which are inherently untrusted sources of user-provided information. - Boundary markers: No explicit delimiters or instructions are provided to the agent to help it differentiate between data values and potential instructions within the processed files.
- Capability inventory: The skill uses
Read,Write,Grep, andGlobtools. The ability to write files poses a risk if the agent is manipulated into performing unauthorized file system operations. - Sanitization: The instructions do not define any sanitization, escaping, or validation logic for the input strings before they are processed by the agent's logic or rendered into HTML reports.
Audit Metadata