company-cfo
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources including bank transaction descriptions, payroll records, and payment processor events, which could contain malicious instructions.
- Ingestion points: Phase 1 pulls raw data from APIs/CLIs into a local data directory; Step 0 reads configuration and memory notes.
- Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious content within the transaction data.
- Capability inventory: The skill utilizes file system operations, Git commands, GitHub CLI, and external financial CLI tools.
- Sanitization: There is no evidence of data sanitization or validation performed on the ingested records.
- [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands and external CLI tools like git, gh, and financial management utilities (e.g., mercury-cli). It also suggests starting a local web server for a scenario projector using python.
- [DATA_EXFILTRATION]: The skill manages highly sensitive financial information. Although it includes safeguards like mandatory .gitignore configuration and targeted git add instructions, the handling of bank balances and payroll data is inherently sensitive when paired with network-capable tools like git and gh.
Audit Metadata