settlement
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local command-line utilities (
ledger.pyandshinkoku) to interact with accounting databases and generate financial reports. Data extracted from files or provided by the user is passed as JSON arguments to these tools.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from several untrusted sources including configuration files, previous progress reports, and user-provided images or PDFs processed via OCR. This data is used to populate parameters for subsequent shell command executions.\n - Ingestion points:
shinkoku.config.yaml, files within.shinkoku/progress/, and user-supplied tax documents (images/PDFs).\n - Boundary markers: The instructions do not define explicit boundary markers or isolation protocols for untrusted data.\n
- Capability inventory: The skill can read and write files within the project directory and execute specific local binaries.\n
- Sanitization: No explicit sanitization or validation steps are defined in the instructions; the skill relies on the agent to construct valid JSON for the CLI tools. The skill does include a policy to seek user confirmation before registering any ledger entries.
Audit Metadata