startup-due-diligence
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external startup documents for due diligence. This represents an attack surface where adversarial content in analyzed documents could attempt to influence the agent's findings. However, the risk is mitigated by the deterministic nature of the report-generation scripts.\n
- Ingestion points: Intake and document review workflow defined in SKILL.md.\n
- Boundary markers: Structured markdown checklists in the references/checklists/ directory provide specific criteria for analysis.\n
- Capability inventory: Local file reading and writing via standard Python libraries (python-docx) in scripts/populate_template.py.\n
- Sanitization: The skill utilizes a deterministic placeholder replacement mechanism for output generation, ensuring that user-provided data is not interpreted as executable code.\n- [EXTERNAL_DOWNLOADS]: The skill references standard Python libraries (python-docx and openpyxl) in scripts/requirements.txt for processing Word and Excel files. These are well-known, legitimate dependencies.
Audit Metadata