market-report
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Installs the
reportlablibrary from the official Python Package Index (PyPI) if it is not detected on the host system. - [COMMAND_EXECUTION]: Executes shell commands to verify dependency availability and runs a local Python script (
scripts/generate_pdf_report.py) to process JSON data and generate PDF files. - [PROMPT_INJECTION]: The skill processes untrusted data from multiple external files which presents an indirect prompt injection surface.
- Ingestion points: Reads content from files such as
MARKETING-AUDIT.md,SEO-AUDIT.md, and others in the project root. - Boundary markers: Missing. There are no clear delimiters or instructions telling the model to ignore potential command-like text within the ingested audit files.
- Capability inventory: The skill has the ability to execute shell commands (
pip3,python3), write files, and delete temporary files (/tmp/report_data.json). - Sanitization: Missing. The instructions do not specify any validation, escaping, or filtering for the content extracted from the local markdown files before it is used in the report assembly or passed to the generator script.
Audit Metadata