china-holidays
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/fetch_holidays.pyscript performs network requests tosousuo.www.gov.cnand extracted URLs fromwww.gov.cnto retrieve official holiday notifications. These domains belong to the official government portal of China, which is a well-known public service for this type of data. - [COMMAND_EXECUTION]: The skill instructs the agent to execute the
scripts/fetch_holidays.pyscript using the shell to perform data retrieval and manage local cache files in theassets/directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes content fetched from external government URLs, which is then presented to the agent, creating a surface for indirect prompt injection.
- Ingestion points: The
scripts/fetch_holidays.pyscript fetches HTML content from external government search results and notification pages. - Boundary markers: Absent. The data is retrieved as text and interpolated directly into the agent's workflow.
- Capability inventory: The
scripts/fetch_holidays.pyscript possesses network access capabilities (viaurllib.request) and file system write access for caching retrieved notifications to theassets/folder. - Sanitization: Present. The script includes an
extract_chinese_textfunction that uses regular expressions to strip HTML tags and scripts, filtering the content to retain only Chinese characters, digits, and basic punctuation.
Audit Metadata