quality-screen
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data fetched from external, untrusted web sources (via
WebSearch) to evaluate financial metrics. If these external sources contain malicious instructions, the agent could potentially be influenced, although the risk is limited by the specific financial context. - Ingestion points: External financial data and reports are retrieved using
WebSearchinSKILL.md(Step 2). - Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings for the fetched data.
- Capability inventory: The skill has access to
WebSearch,Bash(executing local tools likefinancial_rigor.py), and file systemRead/Writeoperations. - Sanitization: There are no instructions for sanitizing or escaping the content retrieved from the web before it is analyzed by the agent.
Audit Metadata