market-research-reports
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Python orchestration script (
scripts/generate_market_visuals.py) that usessubprocess.runto execute other local visualization scripts. This is a standard pattern for the skill's batch-generation functionality and uses safe argument passing (list format) to mitigate command injection risks. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external sources via research tools to populate the LaTeX reports.
- Ingestion points: Data gathered through
research-lookup.pyis integrated into the report chapters (documented inSKILL.md). - Boundary markers: The skill does not currently define explicit delimiters or instructions to the agent to ignore instructions embedded in research data.
- Capability inventory: The agent has access to
Bash,Write,Edit, andReadtools. - Sanitization: No explicit sanitization or filtering of the external research data is performed before it is written to the LaTeX project files.
Audit Metadata