bottleneck-hunter

Pass

Audited by Gen Agent Trust Hub on Jul 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill's primary functions are consistent with its stated purpose of identifying supply chain arbitrage opportunities through financial and logistical research.
  • [EXTERNAL_DOWNLOADS]: The skill uses WebSearch to retrieve real-time data on industry trends, capex plans, and market shares. This is standard functionality for research-oriented skills and follows established project guidelines.
  • [COMMAND_EXECUTION]: The skill instructs the agent to run project-local tools (e.g., python3 tools/financial_rigor.py) for precise arithmetic and valuation. This relies on the security of the tools provided within the user's own repository environment.
  • [PROMPT_INJECTION]: The skill has a surface area for indirect prompt injection due to its reliance on external web data (Category 8).
  • Ingestion points: Results from WebSearch queries regarding supply chain shortages and manufacturer data (SKILL.md).
  • Boundary markers: The instructions lack specific delimiters or warnings to the agent to ignore instructions embedded in the external search results.
  • Capability inventory: The skill utilizes WebSearch for data gathering, Bash for local script execution, and Write for report generation.
  • Sanitization: No explicit validation or filtering process for the fetched external content is described.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 18, 2026, 07:18 AM
Security Audit — agent-trust-hub — bottleneck-hunter