reconciliation

Warn

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill instructions describe a workflow where the agent discovers and executes tools dynamically. Specifically, it uses sandbase_discover to find a capability, sandbase_inspect to retrieve its details, and then sandbase_run using the name returned at runtime. This 'call-by-name' pattern where the target tool is not statically defined represents dynamic execution from computed identifiers. \n- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from report pages using scraping and extraction tools, creating a vulnerability surface for indirect prompt injection. \n
  • Ingestion points: SKILL.md (processing report URLs) and references/sandbase-api-map.md (referencing context_dev_extract_structured_data and context_dev_scrape_markdown for data retrieval). \n
  • Boundary markers: The instructions do not define explicit delimiters or boundary markers for the ingested content. \n
  • Capability inventory: The skill possesses the capability to execute tools via sandbase_run as described in SKILL.md. \n
  • Sanitization: No specific sanitization, filtering, or validation logic for the retrieved external data is present in the instructions.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 4, 2026, 11:46 AM