tanzania
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to process data from various external sources, including Tanzanian government websites and local CSV files. This creates a potential vector for data-driven injection where untrusted external content could attempt to influence the agent's behavior.
- Ingestion points: External websites such as tra.go.tz, nbs.go.tz, brela.go.tz, and tic.go.tz, alongside the local reference file references/economic-metrics.csv.
- Boundary markers: Includes specific instructions to "verify time-sensitive facts before relying on them" and to "label time-sensitive facts not assessed," providing procedural guardrails for handling ingested data.
- Capability inventory: The skill references the execution of a local Python script (tools/scrape_metrics.py) to process external data.
- Sanitization: No automated sanitization or filtering logic is detailed in the provided instructions; reliance is placed on human verification and explicit caveats.
- [COMMAND_EXECUTION]: The skill contains instructions for the agent or user to execute a local Python script to populate economic metrics.
- Evidence: Found in the SKILL.md file:
run python tools/scrape_metrics.py tanzaniato populate metrics.
Audit Metadata