vpe-review
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (delivery_throughput_analyzer.py, eng_hiring_funnel_calculator.py, eng_team_structure_designer.py) located within the skill's defined vendor directory structure to process and analyze engineering data.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external JSON data (sprint_metrics.json, funnel.json, team.json) representing engineering metrics. While no explicit boundary markers or sanitization logic are defined in the instructions, the attack surface is managed as the data is consumed by scripts rather than directly interpolated into the LLM's primary prompt instructions.
Audit Metadata