capital-allocation
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns such as prompt injection, data exfiltration, or obfuscation were found in the skill or the accompanying script.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external initiative data (cost, return, names) to generate an allocation plan. This is an expected data ingestion surface for a capital allocation tool.\n
- Ingestion points: Data is ingested from a user-provided JSON file or standard input by the
scripts/capital_allocate.pyscript.\n - Boundary markers: The instructions do not specify boundary markers or directives to ignore embedded instructions when the agent processes the script's output.\n
- Capability inventory: The associated script uses only the Python standard library and performs no network requests, file system writes, or dynamic code execution.\n
- Sanitization: The script performs JSON parsing and numeric type conversion, which provides basic structural validation, but does not sanitize string content for potential prompt injection.
Audit Metadata