delay-tracker
Pass
Audited by Gen Agent Trust Hub on Mar 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection as it processes data from multiple external sources.
- Ingestion points: The skill reads and interprets data from several project files, including
schedule.json,specs-quality.json,daily-report-data.json,cost-data.json,labor-tracking.json, anddelay-log.json(as described in the 'Project Intelligence Integration' section ofSKILL.md). - Boundary markers: There are no explicit delimiters or instructions within the prompt to ignore potentially malicious instructions embedded in the project data files.
- Capability inventory: The skill's capabilities are focused on data analysis, mathematical calculations for project extensions, and generating text-based reports. No high-risk capabilities such as network requests, file-system writes to sensitive paths, or subprocess execution were detected.
- Sanitization: The instructions do not specify any validation, escaping, or sanitization protocols for the external data before it is processed by the agent.
Audit Metadata