leiloeiro-avaliacao

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to fetch and process data from external real estate portals, creating a surface for potential injection of malicious instructions via user-generated listings.
  • Ingestion points: The references/detailed-guide.md file instructs the agent to research and collect data from external sites including ZAP Imóveis, Viva Real, OLX, and Quinto Andar.
  • Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the fetched data defined in the skill's guidelines.
  • Capability inventory: The skill includes scripts/governance.py, which has the capability to perform file write operations (creating and appending to action_log.jsonl).
  • Sanitization: The skill does not define any sanitization, filtering, or validation steps for the content retrieved from external websites before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 09:18 PM