expansion-revenue-finder
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local files (CSV, JSON, Markdown, Text) using Glob and Grep to identify expansion opportunities.\n
- Ingestion points: references/data-inputs.md specifies reading account, usage, and product data from the filesystem.\n
- Boundary markers: Not present.\n
- Capability inventory: Uses Bash, Read, and Write tools.\n
- Sanitization: No validation or sanitization is performed on the ingested data before processing.\n- [DATA_EXFILTRATION]: The skill is designed to locate and analyze highly sensitive business and financial information.\n
- Evidence: references/data-inputs.md instructs the agent to search for keywords including ARR, MRR, revenue, contract, billing, and API.\n
- Capability: While no dedicated network tool is listed, the inclusion of the Bash tool provides a mechanism for potential data exfiltration.\n- [COMMAND_EXECUTION]: The skill requests access to the Bash tool.\n
- Evidence: SKILL.md lists Bash as an allowed tool to facilitate searching for account data via Glob and Grep patterns.
Audit Metadata