raffle-winner-picker
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFENO_CODEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Risk. The skill instructs the agent to process content from external sources which could contain adversarial instructions targeting the agent's behavior.
- Ingestion points: The skill processes data from Google Sheets URLs and local files (e.g., entries.csv, contest-entries.xlsx) as described in SKILL.md.
- Boundary markers: No specific delimiters or safety instructions are provided to help the agent distinguish between data and potential commands within the winner lists.
- Capability inventory: The skill implies the use of web-browsing capabilities to fetch Google Sheets and file-system access to read spreadsheets.
- Sanitization: There is no mention of validation or sanitization protocols for the data being ingested.
- [NO_CODE]: The skill is composed entirely of a markdown documentation file (SKILL.md) and does not include any executable scripts, binaries, or source code.
Audit Metadata