market-research-reports
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides a suite of local Python scripts for data validation and market-sizing calculations. These tools are restricted to the Python standard library and explicitly exclude dangerous operations such as dynamic code evaluation, network requests, or unsafe deserialization.
- [SAFE]: Robust path resolution and input validation are implemented in
scripts/_common.py. The scripts use resolve-based path checks that reject symlinks and ensure file operations remain within the intended workspace, effectively mitigating path traversal risks. - [SAFE]: The skill instructions and reference documents (e.g.,
references/methods_and_ethics.md) establish strong security and ethical boundaries, including explicit mandates for data minimization, PII protection, and the avoidance of deceptive data collection. - [INDIRECT_PROMPT_INJECTION]: The skill processes external research data in CSV and JSON formats, which is a potential ingestion point for indirect prompt injection. However, the risk is mitigated by strict schema enforcement, regex-based identifier validation, and character limits within the bundled scripts. The agent is further instructed to audit all claims against verified local ledgers.
- [EXTERNAL_DOWNLOADS]: The skill references authoritative government and international data sources, such as the SEC, U.S. Census Bureau, OECD, and IMF. These are well-known technology and government services. The instructions specify that bundled scripts perform no automated retrieval and that any network access requires user approval.
Audit Metadata