onboard
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill facilitates a structured interview to generate a local configuration file (
~/.claude/company-context.md). This behavior is consistent with its stated purpose of providing context to an AI agent acting as a business advisor. - [DATA_EXPOSURE]: The skill is designed to collect and store highly sensitive business intelligence, including revenue figures, growth rates, monthly burn, and strategic risks, in a plain-text markdown file. While this is the primary function of the skill, users should be aware that this sensitive information is consolidated in a predictable local file path.
- [INDIRECT_PROMPT_INJECTION]: The skill represents an ingestion surface as it captures user input and writes it to a file that other skills (like
context-engineorcs-chief-of-staff) are intended to read. - Ingestion points: User responses to the 12-question interview (SKILL.md).
- Boundary markers: The output uses structured markdown headers and bullet points, but there are no specific instructions to ignore embedded commands in the user's input.
- Capability inventory: The skill performs file system writes to
~/.claude/company-context.mdand suggests the use of symlinks (ln -sf). - Sanitization: No explicit sanitization or validation of the user's input is performed before writing it to the durable context file.
Audit Metadata