octave-win-loss-report
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches styling assets from Google Fonts, a well-known and trusted service.
- [COMMAND_EXECUTION]: Instructs the agent to open the generated HTML report in the local web browser after creation.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from CRM data and conversation findings into HTML visualizations. * Ingestion points: Fetches deal events and call findings via list_events and list_findings in SKILL.md. * Boundary markers: None implemented for the HTML output templates. * Capability inventory: Generates local files and triggers browser execution. * Sanitization: There are no instructions to sanitize or escape external data before it is rendered in the HTML report.
Audit Metadata