skills/qonto/skills/veto/Gen Agent Trust Hub

veto

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute its local Python scripts for business identity and VAT validation. It includes explicit instructions to sanitize inputs by filtering characters and enforcing strict formats before shell interpolation, protecting against potential command injection.- [EXTERNAL_DOWNLOADS]: The skill interacts with well-known official services provided by the European Commission and the French government to verify business status and VAT compliance. These network requests are scoped specifically to verifying identity data against authoritative registries.- [INDIRECT_PROMPT_INJECTION]: While the skill processes external data from Qonto and government APIs, it implements defensive instructions that command the agent to treat all fetched values as data rather than instructions. Every write operation is guarded by a mandatory human confirmation step, mitigating risks associated with untrusted data ingestion.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 07:37 PM