Add School Calendar
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data from school board websites and PDFs to extract dates and events, which introduces a surface for indirect prompt injection. \n
- Ingestion points: Data is retrieved from user-provided or searched URLs via
scrape_board_calendar.pyand from PDF documents via the Read tool as described inSKILL.md. \n - Boundary markers: The skill instructs the agent to use a specific markdown template (
references/calendar-template.md), which provides structural isolation for the ingested data. \n - Capability inventory: The skill utilizes shell commands (
curl) and local Python scripts (summer_dates.py,scrape_board_calendar.py) for file management and data processing. \n - Sanitization: Extracted files are validated by
validate_calendar.pyfor correct formatting, but no advanced content filtering for prompt injection patterns is mentioned.\n- [EXTERNAL_DOWNLOADS]: The skill usescurlto download school calendar PDFs from external URLs. These files are saved to the local filesystem within a defined directory structure for further processing.\n- [COMMAND_EXECUTION]: The workflow involves executing local Python scripts and shell commands to automate data extraction and validation. These operations are conducted on files within the skill's reference and research directories.
Audit Metadata