bottleneck-hunter
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill's primary functions are consistent with its stated purpose of identifying supply chain arbitrage opportunities through financial and logistical research.
- [EXTERNAL_DOWNLOADS]: The skill uses
WebSearchto retrieve real-time data on industry trends, capex plans, and market shares. This is standard functionality for research-oriented skills and follows established project guidelines. - [COMMAND_EXECUTION]: The skill instructs the agent to run project-local tools (e.g.,
python3 tools/financial_rigor.py) for precise arithmetic and valuation. This relies on the security of the tools provided within the user's own repository environment. - [PROMPT_INJECTION]: The skill has a surface area for indirect prompt injection due to its reliance on external web data (Category 8).
- Ingestion points: Results from
WebSearchqueries regarding supply chain shortages and manufacturer data (SKILL.md). - Boundary markers: The instructions lack specific delimiters or warnings to the agent to ignore instructions embedded in the external search results.
- Capability inventory: The skill utilizes
WebSearchfor data gathering,Bashfor local script execution, andWritefor report generation. - Sanitization: No explicit validation or filtering process for the fetched external content is described.
Audit Metadata