biz-health-check

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/biz_health_check.py dynamically loads and executes Python modules from sibling directories using importlib.util. The module paths are computed relative to the script's location (_REPO_ROOT / skill_dir / "scripts" / filename). This facilitates a modular architecture where the composite skill reuses logic from independent sub-skills.
  • [INDIRECT_PROMPT_INJECTION]: The skill acts as a data aggregator for business-related information, creating a surface for potential indirect prompt injection through processed external content.
  • Ingestion points: Business registration numbers (b_no), company names (name), and regional parameters (region) provided to the run function in scripts/biz_health_check.py.
  • Boundary markers: The skill output includes a clear disclaimer field stating that the report is a collection of facts without interpretation, intended for the user's evaluation.
  • Capability inventory: The script performs dynamic module loading and passes configuration (like base_url) to modules that perform network-based queries.
  • Sanitization: The _normalize_b_no function uses regular expressions (re.sub and re.fullmatch) to strictly validate that the registration number is a 10-digit numeric string.
  • [EXTERNAL_DOWNLOADS]: The skill uses a vendor-owned CLI tool, @nomadamas/k-skill, which is fetched and executed via npx as described in SKILL.md and instruction.md. This tool is used to synchronize instructions and manage the skill's execution environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 02:30 PM