card-sort-analysis
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted user data via $ARGUMENTS and external files (e.g., spreadsheets, card sort results). This creates a surface for indirect prompt injection where malicious instructions embedded within the user data could influence the agent's behavior during analysis.
- Ingestion points: $ARGUMENTS and user-provided files mentioned in SKILL.md.
- Boundary markers: Absent; there are no instructions provided to the agent to treat the input data as potentially untrusted or to ignore embedded instructions.
- Capability inventory: The skill relies on standard agent capabilities to read files and generate analytical reports.
- Sanitization: There is no evidence of sanitization, validation, or escaping of the input data processed by the skill.
Audit Metadata