company-innovation-assessment
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill automatically downloads assessment reports from a dynamically generated URL (
report_url). It implements rigorous security checks to mitigate download risks: enforcement of HTTPS, validation that the URL and all redirects resolve to public IP addresses (blocking localhost, loopback, and private ranges), and verification that redirect hosts match the original source. - [INDIRECT_PROMPT_INJECTION]: The skill aggregates data from multiple external tools, which serves as an ingestion point for potentially untrusted content. Ingestion points: Data is received from the
search_companytool and four corporate analysis tools (SKILL.md). Boundary markers: No explicit delimiters are specified for tool-to-tool data transfers, though the data is handled as structured objects. Capability inventory: The skill has file-write capabilities through its automated download and save feature. Sanitization: The skill performs post-download verification of the file structure to ensure it contains expected report markers (TECH INNOVATION ASSESSMENT).
Audit Metadata