vpe-advisor
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: A comprehensive security audit of the skill's instructions, reference documentation, and utility scripts found no malicious patterns, obfuscation, or safety bypass attempts. The skill is well-structured and follows best practices for a decision-support tool.
- [COMMAND_EXECUTION]: The skill includes three Python scripts:
delivery_throughput_analyzer.py,eng_hiring_funnel_calculator.py, andeng_team_structure_designer.py. These scripts use only the Python standard library (argparse,json,math,sys) to perform mathematical calculations on input JSON data. They do not invoke shell commands, spawn subprocesses, or perform any dangerous system operations. - [DATA_EXFILTRATION]: There are no network-enabled operations (e.g., HTTP requests) or attempts to access sensitive local files (e.g., SSH keys, AWS credentials, or
.envfiles). Data processing is strictly local and restricted to the input provided by the user. - [PROMPT_INJECTION]: The markdown instructions in
SKILL.mdand associated references contain no patterns designed to override agent behavior, extract system prompts, or bypass safety guidelines. The instructional language is professional and domain-specific. - [REMOTE_CODE_EXECUTION]: No external downloads or dependencies are required or attempted. The skill does not execute code from remote sources or untrusted domains.
Audit Metadata