advanced-analytics-dashboard
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface where untrusted data is ingested from user responses regarding business decisions and metrics (Step 2 in SKILL.md). This data is then interpolated into machine-readable artifacts like SQL DDL and JSON Schema. While no explicit sanitization or boundary markers are defined in the instructions, the skill's scope is restricted to emitting empty templates or synthetic examples, which significantly reduces the risk of exploitation. Evidence chain: Ingestion points (Step 2), Boundary markers (Absent), Capability inventory (CSV/SQL/JSON generation), Sanitization (Absent).
- [EXTERNAL_DOWNLOADS]: The documentation references external resources and related modules hosted on the vendor's GitHub repository. These references are used solely for documentation and providing an extensions catalog, representing standard vendor behavior without automated remote code execution risks.
- [NO_CODE]: The skill consists entirely of markdown-based instructions and does not include any scripts, executables, or binary assets, limiting its capabilities to text-based interaction and artifact generation.
Audit Metadata