us-gov-shutdown-tracker
Warn
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- COMMAND_EXECUTION (MEDIUM): The skill instructs the agent to run local Python scripts (
scripts/analyze_shutdown.pyandscripts/visualize.py) via the command line. These scripts represent the core logic of the skill, but their content is not available for inspection within the provided definition, posing a risk of unverified behavior.\n- EXTERNAL_DOWNLOADS (LOW): The skill requires network access to fetch financial data from the Federal Reserve Economic Data (FRED) API. While FRED is a highly trusted institutional source, this creates a dependency on external connectivity and remote data ingestion.\n- PROMPT_INJECTION (LOW): The 'Onboarding Guidance' section contains instructions that attempt to constrain the agent's behavior to a specific user question and explicitly forbid broader explorations. While intended for functional focus, this pattern uses imperative overrides to dictate the agent's conversational scope.\n- INDIRECT_PROMPT_INJECTION (LOW): The skill possesses an attack surface (Category 8) as it ingests untrusted data from an external API (FRED) and user-supplied date parameters. The ingested data is processed by local scripts and written to files (results.json), though the risk is mitigated by the trusted nature of the data source.
Audit Metadata