assessment-builder
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows secure coding practices by using
yaml.safe_load()in its validation script (validate-assessment.py), preventing unsafe deserialization attacks when processing assessment files. - [COMMAND_EXECUTION]: The skill utilizes a local Python script to perform cognitive analysis on assessment data. The script logic is restricted to internal data processing and does not involve network requests, sensitive file access, or arbitrary command execution.
- [PROMPT_INJECTION]: The skill processes assessment data through its validation script, creating a surface for indirect prompt injection. The risk is managed by using safe parsing and limiting the script to local data analysis. Evidence: (1) Ingestion point: assessment.yml; (2) Boundary markers: none; (3) Capability inventory: data processing only; (4) Sanitization: yaml.safe_load.
Audit Metadata