tech-alliance-leader-scout
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data from T1-T8 sources, including web searches, policies, and industry reports, which represents a vulnerability surface for indirect prompt injection.
- Ingestion points: Defined in
SKILL.mdunder the 'Data Source Rules' (T1-T8), encompassing policy web retrieval, market data, bluebooks, and user-supplied candidate lists. - Boundary markers: The skill implements instructions to prevent the agent from obeying embedded instructions by requiring the use of a 'four-dimensional framework' for validation and explicitly labeling unverified data as '待补充' (to be supplemented).
- Capability inventory: Based on
SKILL.md, the agent's actions are limited to generating HTML reports and structured JSON retrieval plans; no subprocess calls, arbitrary file writing, or sensitive network exfiltration tools are utilized. - Sanitization: The instructions require specific data provenance, such as page numbers for yearbooks, official document numbers for policies, and 'company tree' merging for patent data to ensure integrity and prevent data manipulation.
Audit Metadata