ab-test-setup
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from an external file (
.claude/product-marketing-context.md), which represents a potential surface for indirect prompt injection if the file contains malicious instructions. - Ingestion points:
SKILL.mddirects the agent to read.claude/product-marketing-context.mdfor background context. - Boundary markers: Absent; the instructions do not include delimiters or warnings to ignore potential instructions embedded within the marketing context file.
- Capability inventory: The skill possesses the capability to execute shell commands through the bundled
scripts/sample_size_calculator.pytool. - Sanitization: Absent; the agent is not instructed to validate or sanitize values retrieved from the context file before using them as arguments for the calculation script.
- [COMMAND_EXECUTION]: The skill includes and executes a local Python script,
scripts/sample_size_calculator.py, to perform statistical calculations. The script is part of the skill's own package and performs its intended mathematical functions using standard libraries. - [EXTERNAL_DOWNLOADS]: The documentation provides reference links to well-known and established A/B testing services (such as Evan Miller, Optimizely, and VWO) for cross-verifying sample size results.
Audit Metadata