usfiscaldata
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from the U.S. Treasury Fiscal Data API (e.g.,
api.fiscaldata.treasury.gov). This represents a potential indirect prompt injection surface if the external data source were to contain malicious instructions. - Ingestion points: Data is fetched via
requests.get()calls inSKILL.mdandreferences/examples.md. - Boundary markers: The skill does not explicitly define delimiters or instructions to ignore embedded content in the API responses.
- Capability inventory: The skill has access to
Bash,Read,Write, andEdittools as defined inSKILL.md. - Sanitization: Code examples demonstrate standard parsing of JSON and CSV data into DataFrames, which provides structural validation but not semantic sanitization against prompt injection.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install standard, well-known Python packages (
requests,pandas) using standard package managers. - Downloads: Fetches financial data and documentation from official U.S. Treasury domains (
api.fiscaldata.treasury.gov,fiscaldata.treasury.gov) and citation metadata from arXiv (arxiv.org).
Audit Metadata