statistical-analysis-advisor
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python and R scripts (referenced as
scripts/main.py) to perform statistical calculations, assumption checking, and power analysis. This is the primary intended function of the tool. - [EXTERNAL_DOWNLOADS]: The skill instructions specify the installation of Python dependencies from a
requirements.txtfile usingpip. While the specific package list was not provided, this is a standard setup procedure for Python-based agent skills. - [DATA_EXFILTRATION]: The skill is documented to read input datasets and write output files to the agent's workspace. This represents a data access surface, although no unauthorized network exfiltration or sensitive file access (such as credentials or SSH keys) was observed in the provided files.
- [PROMPT_INJECTION]: The skill processes external data regarding dataset characteristics and potentially raw data content to generate recommendations. This creates an indirect prompt injection surface where malicious instructions embedded in a dataset could attempt to influence agent behavior. The skill includes documentation claiming to validate input paths and sanitize error messages as mitigations.
Audit Metadata