partner-webhook-analyzer
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The provided Python script (
run.py) is a minimal scaffold that reads a JSON file from a user-specified path, extracts the dictionary keys, and writes a status report to another user-specified path. It does not perform any network operations, access sensitive system files (like credentials or SSH keys), or execute dynamic code. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external data (webhook signals in JSON/CSV format), which is an inherent property of its design as an analyzer.
- Ingestion points: Data is ingested via
input_path.read_text()inrun.py, where the path is provided as a command-line argument. - Capability inventory: The script has standard file system read and write capabilities (
pathlib.Path.read_textandpathlib.Path.write_text). - Boundary markers: As a reference scaffold, it does not currently implement specific boundary markers or "ignore instruction" prompts for the processed data.
- Sanitization: The script performs standard
json.loads()parsing but does not include additional sanitization, which is typical for a tool intended to process structured business data.
Audit Metadata