live-event-survey-analysis-skill
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from a Google Drive spreadsheet and user-supplied claim files, which provides a surface for indirect prompt injection.
- Ingestion points: Data enters the system via
survey.xlsx(processed inload_survey.py) and user-specified claim files in text or JSON format (processed inanalyze.py). - Boundary markers: The instructions do not include explicit boundary markers or directives to ignore instructions that might be embedded within the survey data.
- Capability inventory: The included scripts are limited to file reading, writing, and statistical analysis; no dangerous capabilities such as arbitrary command execution, network operations, or dynamic code evaluation were detected.
- Sanitization: Content from survey cells and claim strings is not sanitized or filtered before being presented to the agent.
Audit Metadata