china-holidays

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/fetch_holidays.py script performs network requests to sousuo.www.gov.cn and extracted URLs from www.gov.cn to retrieve official holiday notifications. These domains belong to the official government portal of China, which is a well-known public service for this type of data.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute the scripts/fetch_holidays.py script using the shell to perform data retrieval and manage local cache files in the assets/ directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes content fetched from external government URLs, which is then presented to the agent, creating a surface for indirect prompt injection.
  • Ingestion points: The scripts/fetch_holidays.py script fetches HTML content from external government search results and notification pages.
  • Boundary markers: Absent. The data is retrieved as text and interpolated directly into the agent's workflow.
  • Capability inventory: The scripts/fetch_holidays.py script possesses network access capabilities (via urllib.request) and file system write access for caching retrieved notifications to the assets/ folder.
  • Sanitization: Present. The script includes an extract_chinese_text function that uses regular expressions to strip HTML tags and scripts, filtering the content to retain only Chinese characters, digits, and basic punctuation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 09:24 AM