skills/tmssoftware/skills/flexcel-vcl/Gen Agent Trust Hub

flexcel-vcl

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process external Excel files and templates, which constitutes a surface for indirect prompt injection attacks.\n
  • Ingestion points: Untrusted data enters the agent's context through methods like TXlsFile.Create(Source) and TFlexCelReport.Run(Template, ...) described in SKILL.md and the reference guides.\n
  • Boundary markers: No explicit instructions or delimiters to distinguish between data and embedded instructions were identified.\n
  • Capability inventory: The agent utilizing this skill has the capability to write files to the local system (xls.Save), export data to PDF/HTML format (pdf.Export), and perform formula calculations (xls.Recalc).\n
  • Sanitization: There is no mention of sanitizing or validating external cell content or report tags before processing.\n- [EXTERNAL_DOWNLOADS]: The skill provides instructions for the agent to fetch documentation and code examples from remote sources.\n
  • Evidence: SKILL.md contains instructions to use WebFetch to retrieve content from https://raw.githubusercontent.com/tmssoftware/TMS-FlexCel.VCL-doc-src/main/.\n
  • Context: The target repository is the official documentation source for the library on GitHub, which is a well-known service.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 11:59 PM