voice-of-customer-synthesizer
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves customer review data from the official Apify platform (api.apify.com), a well-known service used for web scraping.
- [DATA_EXFILTRATION]: The scrape_reviews.py script transmits a user-provided APIFY_API_TOKEN to api.apify.com to authenticate scraping requests. This is a functional requirement for the skill's review-aggregation feature.
- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks as it is designed to analyze untrusted text from external customer feedback sources.
- Ingestion points: Data enters the agent context through corpus.json, which contains merged text from CSV files and scraped reviews.
- Boundary markers: None identified; instructions do not specify the use of delimiters to isolate the customer feedback content.
- Capability inventory: The agent can generate markdown reports and send files to a Teams channel.
- Sanitization: No sanitization or instruction filtering is performed on the raw feedback text.
- [COMMAND_EXECUTION]: The skill runs local Python scripts (normalize_feedback.py and scrape_reviews.py) to perform deterministic data merging and interface with the Apify API.
Audit Metadata