social-media-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external social media campaign data (likes, comments, reach, etc.) provided in JSON format.
- Ingestion points: Data enters the system via the
postsarray in the input JSON, which is processed byscripts/calculate_metrics.pyandscripts/analyze_performance.py. - Boundary markers: The system expects structured numeric data but does not explicitly define boundaries or use 'ignore' instructions for descriptive fields like
post_idorcontent_typewhere text might be injected. - Capability inventory: Analysis of all scripts confirms zero use of subprocess calls, system commands, file system write operations, or network requests. The scope is limited to in-memory calculations and text report generation.
- Sanitization: The Python scripts use typed dictionary access and safe mathematical operations, but do not perform secondary sanitization of string-based metadata fields.
- [SAFE]: The skill uses local Python scripts for analysis without requiring external dependencies or remote code downloads. All analysis logic is transparently contained within the provided scripts, and no suspicious activity was detected during the audit of the code logic.
Audit Metadata