send-report

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXFILTRATION]: The skill is designed to read brand configuration and analytics data and send it to external platforms (Slack, Email, Google Sheets). This data movement is the intended functionality of the report delivery system.
  • [COMMAND_EXECUTION]: The skill orchestrates several local Python scripts to process data and generate reports. These scripts (e.g., performance-monitor.py, report-generator.py) are used as internal utilities for the skill's operational logic.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external analytics APIs and user-provided annotations which could theoretically contain instructions. However, the skill incorporates a mandatory user review and approval step (Step 10) before any external delivery, which effectively mitigates this risk. 1. Ingestion points: External analytics data (Step 2) and User-provided annotations (Step 5). 2. Boundary markers: None explicitly defined in instructions, but the mandatory manual approval gate acts as a human-in-the-loop boundary. 3. Capability inventory: Execution of local Python scripts, file read access to brand profiles in the user's home directory, and network output via Slack, Email, and Google Sheets MCP servers. 4. Sanitization: None described for external metrics, relying instead on user review and approval of the generated preview.
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 12:41 AM
Security Audit — agent-trust-hub — send-report