leiloeiro-mercado
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes real estate market data and user queries which serve as potential ingestion points for untrusted content.
- Ingestion points: Real estate property descriptions, market data inputs, and ROI calculation parameters provided by the user as described in SKILL.md.
- Boundary markers: Absent. The skill lacks explicit instructions for the agent to ignore or delimit instructions embedded within processed data.
- Capability inventory: The skill is knowledge-focused with scripts/governance.py using standard libraries for local logging and rate limiting. No network or high-risk file system operations are present.
- Sanitization: Absent. There is no evidence of input validation or escaping for the processed data.
- [DATA_EXFILTRATION]: The SKILL.md file contains a hardcoded absolute local path (C:\Users\renat\skills\agent-orchestrator\scripts\scan_registry.py) in the installation instructions. This leaks the author's local username (renat) and folder structure to the agent context.
- [METADATA_POISONING]: A discrepancy exists between the platform-provided author identity (sickn33) and the author field declared in the skill metadata (renat), which may lead to confusion regarding the skill's origin.
Audit Metadata