kpi-tree-dashboard
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses a local script (scripts/kpi_rag.py) to perform status calculations on KPI data. The script uses standard libraries and does not perform any network operations or access sensitive system files.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external metric data from a JSON configuration file. While this represents a data ingestion surface, the risk is considered safe as the data is used for status calculations and formatted output.\n
- Ingestion points: The script scripts/kpi_rag.py reads a JSON configuration file from the path provided via the --config command-line argument.\n
- Boundary markers: The skill relies on structured JSON format to delimit data fields, but does not implement additional boundary markers for the final printed output.\n
- Capability inventory: The skill executes a local Python script (scripts/kpi_rag.py) which performs file reads and generates text output for the agent.\n
- Sanitization: The script uses the standard json library for parsing, providing implicit type validation for numeric fields, but it does not sanitize metric name strings.
Audit Metadata