statistical-code-generator
Pass
Audited by Gen Agent Trust Hub on Mar 6, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill generates executable SAS and R code through string interpolation in templates, which constitutes a surface for indirect prompt injection (Category 8).
- Ingestion points: Data enters the templates through placeholders such as
{dataset},{treatment_var},{covariates}, and{contrast_statements}in all.sasand.Rfiles. - Boundary markers: The templates do not utilize boundary markers or explicit instructions to the agent to ignore or escape embedded code within the input data.
- Capability inventory: The skill is designed to produce scripts for execution in statistical environments; while it does not execute these scripts itself, the generated output is the intended final product.
- Sanitization: No sanitization or validation of the placeholder values is performed within the provided template files.
- [NO_CODE]: The skill does not contain any executable scripts (such as Python, JavaScript, or Shell) that are executed by the AI agent. All provided files are either Markdown documentation or text-based code templates for external statistical software.
Audit Metadata