form-w-4r
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its design, which involves ingesting external data and possessing potentially exploitable capabilities.
- Ingestion points: The skill reads untrusted external data such as payor statements and retirement plan records (referenced in SKILL.md and filing.md).
- Boundary markers: There are no delimiters or instructions to ignore embedded malicious content within the processed documents.
- Capability inventory: The skill executes local commands using pdftk/pypdf and performs network operations for form submission to financial portals and email services (detailed in filing.md).
- Sanitization: No sanitization or validation protocols are specified for the data extracted from external payor records.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill workflow involves handling sensitive information, including Social Security Numbers and account credentials. Specifically, filing.md (Section 1) instructs the agent to obtain the user's portal credentials (username, password, and MFA) to facilitate form submission. While the skill mandates that these must not be stored, handling active financial session credentials through an AI agent presents an inherent exposure risk.
- [DYNAMIC_EXECUTION]: The skill uses programmatic PDF manipulation tools (pdftk or pypdf) to map and fill forms at runtime (filing.md Section 7). This dynamic assembly of commands based on external field mapping data represents a low-severity dynamic execution risk.
Audit Metadata