israeli-receipt-scanner
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data from Israeli receipts (scanned images, raw OCR text, or HTML). These inputs could contain malicious natural language instructions designed to manipulate the agent's behavior during the parsing and categorization process.
- Ingestion points: Defined in
SKILL.mdandSKILL_HE.mdunder 'Step 1: Prepare the Receipt Image or Text', including images, digital receipts, and raw OCR text. - Boundary markers: The instructions do not provide specific boundary markers (e.g., XML tags or delimiters) to wrap the extracted text, nor do they instruct the agent to ignore any embedded commands within the receipt content.
- Capability inventory: The skill has high capabilities via
allowed-tools, includingBash(python:*),Edit, andWrite, which could be abused if an indirect injection successfully compromises the agent's logic. - Sanitization: There are no explicit instructions to sanitize or escape the extracted text before it is formatted into JSON or CSV for accounting purposes.
Audit Metadata