collab-exec-summary
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements professional best practices such as the McKinsey Pyramid Principle for information hierarchy and enforces data integrity by requiring all quantitative figures to have inline source citations or '[추정]' (estimated) tags.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data (reports in PDF, Markdown, and DOCX formats). While this is the intended primary purpose, it presents an attack surface where malicious instructions hidden in ingested reports could attempt to influence the agent's summary or the behavior of downstream rendering tools like
moai-officer:doc-html-report. - Ingestion points:
SKILL.md(Workflow Step 1) identifies 원본 보고서 (Original Reports) as input. - Boundary markers: The skill does not explicitly instruct the agent to use delimiters or sanitization routines when interpolating external content into the 6-section structure.
- Capability inventory: The skill chains to several external tools for document conversion and rendering (
doc-html-report,doc-pdf,doc-pptx). - Sanitization: Not present in the provided instructions; the agent relies on its inherent safety guardrails.
- [EXTERNAL_DOWNLOADS]: The skill references a font CDN for Korean readability and includes a link to Mordor Intelligence for market data benchmarks. These are recognized as well-known, legitimate services for the stated use case and do not constitute a security risk.
Audit Metadata