lovstudio-expense-report
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to execute a bundled Python script 'scripts/generate_report.py' to generate the final Excel report. This execution is an intended functionality and is gated by a manual user confirmation step.
- [SAFE]: The skill manages indirect prompt injection risks associated with processing untrusted invoice data. Ingestion points: Data is extracted from user-provided images and text descriptions as defined in the 'Workflow' section of SKILL.md. Boundary markers: No specific delimiters or prompt-level instructions are used to isolate untrusted content from system instructions. Capability inventory: The skill possesses the capability to execute local Python scripts using the shell. Sanitization: No automated sanitization of extracted text is implemented. Mitigation: The skill implements a mandatory human-in-the-loop verification step using the 'AskUserQuestion' tool before data is passed to the execution script, effectively mitigating potential injection attacks embedded in invoices.
Audit Metadata