reconciliation
Warn
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructions describe a workflow where the agent discovers and executes tools dynamically. Specifically, it uses
sandbase_discoverto find a capability,sandbase_inspectto retrieve its details, and thensandbase_runusing the name returned at runtime. This 'call-by-name' pattern where the target tool is not statically defined represents dynamic execution from computed identifiers. \n- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from report pages using scraping and extraction tools, creating a vulnerability surface for indirect prompt injection. \n - Ingestion points:
SKILL.md(processing report URLs) andreferences/sandbase-api-map.md(referencingcontext_dev_extract_structured_dataandcontext_dev_scrape_markdownfor data retrieval). \n - Boundary markers: The instructions do not define explicit delimiters or boundary markers for the ingested content. \n
- Capability inventory: The skill possesses the capability to execute tools via
sandbase_runas described inSKILL.md. \n - Sanitization: No specific sanitization, filtering, or validation logic for the retrieved external data is present in the instructions.
Audit Metadata