power-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests study design parameters from user input and external files which are then used to generate executable analysis scripts. This creates a surface where maliciously crafted input could potentially influence the behavior of the agent or the generated code. Evidence: 1. Ingestion points: Study design parameters gathered in Phase 0 and files referenced via the --input flag. 2. Boundary markers: The skill does not define specific delimiters to isolate untrusted input within generated scripts. 3. Capability inventory: Uses Bash, Write, and Edit tools to create and execute analysis code. 4. Sanitization: No explicit sanitization or escaping of user input is specified before interpolation.
- [DYNAMIC_EXECUTION]: The skill dynamically generates and saves R, Stata, or Python scripts (e.g., scripts/R/power_slug.R) at runtime based on parameters provided by the user.
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute the generated statistical scripts and interact with analytical software like R, Stata, or Python.
Audit Metadata