puzzle-iaa-analytics

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a dedicated tool (ae-cli) to perform data analytics queries and python3 to execute a local mathematical script (scripts/parse_curve.py). These operations are confined to the intended analytics workflow and are triggered by the agent within a controlled execution environment.
  • [DYNAMIC_EXECUTION]: The skill invokes a bundled Python script for knee-point and curve detection. The script was analyzed and found to use standard libraries for mathematical logic and JSON processing with no dangerous capabilities or network access.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data ingested from a BI platform (via ae-cli). While this creates an ingestion surface for potentially untrusted data, the risk is mitigated by the highly structured nature of the analytics workflow, the use of predefined templates, and the mandatory user confirmation gates in Step 01. Ingestion point: BI platform via ae-cli. Capability inventory: Command execution, file writing, and publishing to Feishu. Sanitization: Basic validation for numeric project IDs.
  • [SAFE]: The skill uses well-known services like Feishu for reporting and maintains strict control over the execution flow through mandatory confirmation checkpoints.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 03:22 AM
Security Audit — agent-trust-hub — puzzle-iaa-analytics