industry-chain-intelligence
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow involves executing a local Python script located at
scripts/generate_report.pyto render the final HTML intelligence report based on collected data. - [INDIRECT_PROMPT_INJECTION]: The skill processes data retrieved from multiple external sources and MCP tools to generate report content, which presents a surface for indirect prompt injection if the source data contains malicious instructions.
- Ingestion points: Data is ingested from various Patsnap MCP tools including
industry_tech_chain,company_strategy_map,trends,applicant_ranking, and others during Phase 1. - Boundary markers: The skill uses a structured 10-page report template to constrain the output, but SKILL.md does not explicitly define delimiters for raw tool output interpolation.
- Capability inventory: The skill can execute Python scripts and perform file rendering, creating a path from data ingestion to report generation.
- Sanitization: Content is processed by the
scripts/generate_report.pyengine; standard string interpolation is used to populate HTML templates.
Audit Metadata