transilience-report-style
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The smoke test script
reference/test_generate_report.pyutilizessubprocess.runto invoke the generator script and verify output produced during testing. - [EXTERNAL_DOWNLOADS]: The
image_flowablefunction inreference/generate_report.pyusesurllib.requestto fetch images from URLs provided in the input data for inclusion in the findings cards. - [PROMPT_INJECTION]: The skill processes external findings data, representing an indirect injection surface. 1. Ingestion points:
report_data.json(specifically the findings and poc arrays). 2. Boundary markers: Absent in data, relying on structured JSON and prose documentation. 3. Capability inventory: Subprocess calls inreference/test_generate_report.py; network read and PDF file-write inreference/generate_report.py. 4. Sanitization: HTML escaping and PII masking via regular expressions inreference/generate_report.py.
Audit Metadata