puzzle-iaa-analytics
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a dedicated tool (
ae-cli) to perform data analytics queries andpython3to execute a local mathematical script (scripts/parse_curve.py). These operations are confined to the intended analytics workflow and are triggered by the agent within a controlled execution environment. - [DYNAMIC_EXECUTION]: The skill invokes a bundled Python script for knee-point and curve detection. The script was analyzed and found to use standard libraries for mathematical logic and JSON processing with no dangerous capabilities or network access.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data ingested from a BI platform (via
ae-cli). While this creates an ingestion surface for potentially untrusted data, the risk is mitigated by the highly structured nature of the analytics workflow, the use of predefined templates, and the mandatory user confirmation gates in Step 01. Ingestion point: BI platform viaae-cli. Capability inventory: Command execution, file writing, and publishing to Feishu. Sanitization: Basic validation for numeric project IDs. - [SAFE]: The skill uses well-known services like Feishu for reporting and maintains strict control over the execution flow through mandatory confirmation checkpoints.
Audit Metadata