root-cause-investigation
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates and executes Python code for data analysis, including statistical calculations and visualization. This is a primary functionality for the intended use case.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its processing of external data files. 1. Ingestion points: The skill reads metric data and detailed breakdown information from local CSV files ('metric_data.csv', 'detailed_metric_data.csv'). 2. Boundary markers (absent): No delimiters or instructions are used to separate potentially untrusted data values from the agent's operating context. 3. Capability inventory: The skill executes Python code and performs file system operations including reading data and writing reports and visualizations. 4. Sanitization (absent): The provided code does not validate or sanitize inputs from the CSV files before including them in logs or generated reports.
Audit Metadata