excel-lbo-modeler
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external financial data, term sheets, and synergy parameters while having access to powerful system tools like
Bashand file modification commands. This creates a potential surface where malicious instructions hidden in financial documents could be interpreted by the agent. - Ingestion points: Target company financial data, debt term sheet parameters, and acquisition synergy data processed during model construction (referenced in
SKILL.md). - Boundary markers: The instructions in
SKILL.mddo not define explicit delimiters or use specific system instructions to disregard natural language commands found within the provided data. - Capability inventory: The skill is configured with broad capabilities including
Bash(cmd:*),Write,Edit,Read,Grep, andGlob(defined in theallowed-toolsfrontmatter ofSKILL.md). - Sanitization: There is no evidence of automated sanitization, schema validation, or input filtering for the external financial data provided by the user.
Audit Metadata