uganda
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external CSV files (
economic-metrics.csvandeconomic-metrics-history.csv) to inform financial projections. This represents an indirect prompt injection surface where instructions could potentially be embedded within the data source. - Ingestion points: The agent is instructed to read
references/economic-metrics.csvinSKILL.md. - Boundary markers: No specific boundary markers or sanitization instructions are provided for these CSV files.
- Capability inventory: The skill uses the ingested data for reasoning about financial projections and market analysis.
- Sanitization: None mentioned.
- [COMMAND_EXECUTION]: The documentation includes a reference to a local maintenance command
python tools/scrape_metrics.py ugandaused to refresh the context data. This is a legitimate utility for the skill's primary purpose and does not involve remote code execution from untrusted sources. - [SAFE]: The skill does not contain any prompt injection, data exfiltration, or obfuscation patterns. The external URLs referenced (e.g.,
ubos.org,bou.or.ug,ura.go.ug) are official Ugandan government and regulatory domains consistent with the skill's stated purpose.
Audit Metadata