market-research-reports
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill uses the
research-lookuptool to gather market data from external sources as part of its Phase 1 workflow inSKILL.md. This data is then used to populate chapters in a LaTeX report. The lack of explicit boundary markers or sanitization logic for this externally-sourced data presents a surface for indirect prompt injection, where malicious content in search results could theoretically influence the agent's behavior during report generation. - Ingestion points:
SKILL.md(Workflow Phase 1, Step 2). - Boundary markers: Absent.
- Capability inventory:
Bash,Write,Edit, andReadtools;subprocesscalls inscripts/generate_market_visuals.py. - Sanitization: Absent.
- [COMMAND_EXECUTION]: The script
scripts/generate_market_visuals.pyutilizessubprocess.runto execute internal Python scripts for generating report visuals. While it uses argument lists to mitigate shell injection risks, it dynamically builds commands based on user-supplied 'topic' inputs without strict validation of the input string.
Audit Metadata