eu-grant-hunter
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION] (LOW): Potential indirect prompt injection surface detected. The skill processes external grant data from EU funding portals and interpolates it into templates for briefs and dashboards. Mandatory Evidence Chain: 1. Ingestion point: scan_eu_databases.py (referenced script, currently missing from analysis set) reads from external URLs. 2. Boundary markers: The provided markdown and HTML templates do not include explicit 'ignore embedded instructions' delimiters. 3. Capability: The skill has script execution capabilities and writes to the local filesystem at /srv/janus/. 4. Sanitization: Employs basic normalization and slugification, but core sanitization logic in utils.py is unverified.
- [SAFE] (SAFE): Analysis of the 11 provided files found no evidence of hardcoded credentials, malicious persistence, or unauthorized data exfiltration. The skill's behavior is consistent with its stated purpose of grant opportunity discovery and tracking.
Audit Metadata