german-shopping-receipts
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill specifies the execution of the
bqcommand-line utility to interact with BigQuery. The instructionbq query --nouse_legacy_sql --format=pretty '<sql>'inSKILL.mddirects the agent to run shell commands based on generated SQL string. - [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface where user-provided questions are converted into SQL queries.
- Ingestion points: The agent receives natural language questions from the user (referenced in
SKILL.md). - Boundary markers: None. There are no delimiters or instructions to ignore malicious intent embedded in the user's question.
- Capability inventory: The agent is authorized to execute shell commands through the
bqtool, which can read from and potentially write to (depending on GCP permissions) BigQuery datasets. - Sanitization: Absent. The process described in
SKILL.mddoes not include steps to sanitize the SQL or validate that the query is restricted to the intended table.
Audit Metadata