vendor-risk-questionnaire-scorer
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes structured external data (JSON or CSV) which serves as an ingestion point for potential indirect prompt injection attacks if the data contains malicious instructions targeted at the agent.
- Ingestion points: The
run.pyscript reads data from an external file specified by the--inputcommand-line argument. - Boundary markers: The skill instructions in
SKILL.mddo not currently define boundary markers or explicit instructions to ignore embedded commands within the input data. - Capability inventory: The skill uses
pathlibfor file system access, specifically reading from and writing to local paths. - Sanitization: The
run.pyscript parses the input as JSON but does not perform additional validation or sanitization of the content before processing.
Audit Metadata