zach-search-term-analyzer
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs local data analysis on user-provided CSV files. No network operations or external data transmissions are performed during script execution.\n- [SAFE]: The dependencies listed in
requirements.txt(pandas,numpy,matplotlib,seaborn,openpyxl) are standard, reputable packages from official package registries.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface where untrusted data from Amazon reports is ingested by the agent via generated markdown files. While it lacks explicit boundary markers to delimit external content, this processing is essential to the skill's primary function and no malicious exploitation patterns were observed. \n - Ingestion points: CSV files located in the user-specified
data_dirand processed byscripts/analyze_search_terms.py.\n - Boundary markers: Absent. The generated markdown reports (
analysis_reports/*.md) do not include explicit delimiters or warnings to the LLM to ignore instructions within the data.\n - Capability inventory: The skill uses
Read,Glob,Bash,Write,Edit, andGrep.\n - Sanitization: The script does not implement specific sanitization or filtering to prevent prompt injection control characters from being included in the generated reports.
Audit Metadata