csv-excel-merger
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external CSV and Excel files which represents an untrusted data ingestion surface. Content within these files could potentially contain instructions aimed at influencing agent behavior if the merged output is read back into the context.
- Ingestion points: External files are loaded into the agent's environment using
pd.read_csvand handled within theWorkflowsection ofSKILL.md. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the content of the CSV/Excel files strictly as data rather than instructions.
- Capability inventory: The skill utilizes Python with the
pandaslibrary to perform file reads, data concatenation, and file writes. - Sanitization: The instructions focus on structural normalization (column names, data types) but do not perform sanitization of string content to strip potential prompt injection payloads.
Audit Metadata