market-report-pdf
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill checks for and installs the 'reportlab' library via pip if it is not present in the environment. This is a standard dependency for PDF generation and follows best practices for environment setup.
- [COMMAND_EXECUTION]: The skill executes local Python scripts, specifically 'scripts/generate_pdf_report.py' and 'scripts/analyze_page.py', to process data and produce the final PDF output. These scripts are internal to the skill's functionality.
- [PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes data derived from auditing external websites.
- Ingestion points: Data is read from markdown files like 'MARKETING-AUDIT.md' and 'SEO-AUDIT.md' which are intended to be populated from external URL analysis.
- Boundary markers: The instructions do not define specific delimiters or instructions to separate potentially untrusted audit data from the agent's core instructions during the JSON construction phase.
- Capability inventory: The skill utilizes shell command execution for package management (pip) and local script execution.
- Sanitization: No explicit sanitization or validation of the audit data is documented before it is structured into the JSON input for the PDF generator.
Audit Metadata