chief-of-staff
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests founder queries and company context to coordinate actions across 28 advisor roles and write to a persistent log, creating a vulnerability surface.
- Ingestion points: Founder questions and context-engine outputs identified in SKILL.md.
- Boundary markers: Absent; there are no instructions to delimit or ignore instructions embedded within the ingested data.
- Capability inventory: The skill can invoke 28 different advisor roles and orchestration tools, and it has file-write access to the user's home directory.
- Sanitization: Absent; no logic is provided to escape or validate external content before it is interpolated into role-specific prompts.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill is configured to read from and write to a decision log located at ~/.claude/decision-log.md. While this is a primary feature for tracking organizational decisions, it involves access to hidden paths within the user's home directory.
Audit Metadata