excel-bar-chart-visualization
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The Python code uses standard library modules
osandtempfileto manage local file paths and save the generated Excel report to a temporary directory.- [EXTERNAL_DOWNLOADS]: The skill facilitates the retrieval of the generated file by calling an internal platform toolfile_service.get_download_urlto provide the user with a download link.- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by ingesting untrusted data from external Excel workbooks. - Ingestion points: Dataframes derived from Excel workbooks in
SKILL.md. - Boundary markers: None; the skill does not wrap processed data in delimiters to prevent the agent from interpreting data as instructions.
- Capability inventory: File system writes (
to_excel) and internal skill invocation (invoke_skill). - Sanitization: Performs data cleaning via regex for renaming, but lacks validation for embedded natural language instructions.
Audit Metadata