senior-pm
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No malicious override or bypass instructions were detected. The skill uses instructional language that is consistent with its role as a project management assistant.
- [DATA_EXFILTRATION]: No hardcoded credentials or sensitive data access patterns were found. The Python scripts process local data files and do not include any network functionality for exfiltrating information.
- [REMOTE_CODE_EXECUTION]: No remote code execution or unverifiable dependencies were detected. The scripts rely entirely on Python standard libraries (json, argparse, statistics, sys, datetime).
- [COMMAND_EXECUTION]: While the skill involves running local Python scripts, the commands are used for legitimate data analysis and do not incorporate untrusted input into shell execution in a dangerous manner.
- [OBFUSCATION]: No techniques for hiding or encoding malicious content were found. All scripts and documentation are in plain, human-readable text.
- [INDIRECT_PROMPT_INJECTION]: The skill processes project data files (JSON) to generate reports. The surface for indirect injection is minimal as the scripts perform safe parsing and the output is presented as analytical data rather than executable instructions.
- [METADATA_POISONING]: The metadata fields (name, description) accurately reflect the skill's actual functionality and contents.
- [DYNAMIC_CONTEXT_INJECTION]: No use of load-time dynamic execution syntax (e.g., exclamation mark followed by backticks) was found in the documentation.
Audit Metadata