saas-metrics-coach
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local Python scripts (metrics_calculator.py, quick_ratio_calculator.py, and unit_economics_simulator.py) to calculate financial metrics. These scripts use standard libraries and operate on a local scope.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied revenue and customer data and passes it to shell-executed scripts, creating an injection surface.\n
- Ingestion points: Raw business numbers (MRR, churn, spend) are collected from user input in SKILL.md Step 1.\n
- Boundary markers: There are no instructions for the agent to use delimiters or ignore instructions within the user-provided data.\n
- Capability inventory: The skill possesses command-line execution capabilities via the Python scripts listed in the Tools section.\n
- Sanitization: No sanitization or validation logic is defined to protect against malicious input being passed to the shell command arguments.
Audit Metadata