israeli-employee-tax-refund
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill performs legitimate tax refund estimation and provides educational guidance without any evidence of malicious instructions, credential theft, or unauthorized data exfiltration.
- [INDIRECT_PROMPT_INJECTION]: The skill includes a data ingestion surface for tax forms that is properly constrained by input sanitization and clear instructional boundaries. Ingestion points: User-provided Form 106 data and external tax reference sites (SKILL.md Step 2, Reference Links). Boundary markers: Prominent legal disclaimers and structured headers frame the agent's context. Capability inventory: The skill uses Bash to execute a local Python calculation script and WebFetch to retrieve tax documentation. Sanitization: The estimate_refund.py script enforces strict data types for all user inputs using the argparse library.
- [EXTERNAL_DOWNLOADS]: The skill correctly directs users to and fetches data from official Israeli government domains (gov.il, btl.gov.il) and established legal resources (nevo.co.il, kolzchut.org.il), which are treated as trusted sources for this domain.
Audit Metadata