excel-lbo-modeler
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions are focused entirely on professional financial modeling tasks. No evidence of prompt injection, data exfiltration, or malicious persistence was found.
- [COMMAND_EXECUTION]: The skill utilizes an external MCP server (
@negokaz/excel-mcp-server) to perform Excel operations. This tool usage is transparently documented in the prerequisites and is required for the skill's primary function of building spreadsheets. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data collected through natural language queries.
- Ingestion points: User-provided inputs such as target company name and financial metrics are gathered via
AskUserQuestionin Step 1. - Boundary markers: None explicitly defined for user inputs.
- Capability inventory: File system operations (
Write,Edit) and tool execution via the Excel MCP server. - Sanitization: The skill includes a dedicated validation step (Step 2) that filters inputs based on realistic industry ranges (e.g., verifying multiples between 6-15x and leverage below 7x), which mitigates risks from malformed or malicious data inputs.
Audit Metadata