kanchi-dividend-us-tax-accounting
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
SKILL.mdinstructions andPrerequisitessection direct the agent or user to execute a local Python scriptscripts/build_tax_planning_sheet.pyusingpython3. This script is part of the skill's core functionality for generating tax planning artifacts. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could potentially contain malicious instructions intended to influence the agent's behavior during the reporting phase.
- Ingestion points: The script
scripts/build_tax_planning_sheet.pyingests data from a user-specified JSON file (--input /path/to/tax_input.json) usingjson.loads(). - Boundary markers: There are no explicit boundary markers or instructions within the processing script to ignore potential NLP-based instructions embedded within string fields like
tickerornote. - Capability inventory: The script's capabilities are limited to reading local files and writing generated reports (Markdown and CSV) to a local output directory. It does not perform network operations, subprocess execution, or dynamic code evaluation.
- Sanitization: The script performs standard JSON parsing and basic type conversion (e.g.,
int(hold_days_raw)) but does not sanitize string inputs before interpolating them into the Markdown or CSV output strings.
Audit Metadata