refund-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses specific vendor-owned tools (
ZohoBilling_List_all_Organizations,ZohoBilling_Get_Refund_History_Report, etc.) to fetch billing data. These tools are scoped to the vendor's ecosystem and used for their intended analytical purpose. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from billing reports which could theoretically contain malicious content, but the risk is minimal as the skill lacks write capabilities or shell access.
- Ingestion points: Refund history, product-wise, and country-wise reports fetched from SKILL.md.
- Boundary markers: The skill instructions provide a strict output schema to structure the gathered data.
- Capability inventory: The skill is restricted to data retrieval and reporting; no shell execution, network exfiltration, or file modification tools are present.
- Sanitization: The skill relies on structured anomaly detection logic (thresholds and spikes) which reduces the risk of treating ingested strings as instructions.
Audit Metadata