transformation-roadmap
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill functions as a coach that guides the user through diagnostic steps to produce a transformation roadmap. Its actions, including context-gathering from local files and generating a markdown plan, are appropriate for its stated purpose.
- [PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection because it reads untrusted data from the local workspace to inform its behavior. 1. Ingestion points: Reads from CLAUDE.md, team-profile.md, team-assessment.md, and directories like .claude/rules/ and skills/ (SKILL.md). 2. Boundary markers: No delimiters are specified to isolate workspace content from agent instructions. 3. Capability inventory: The skill writes a transformation-roadmap.md file to the workspace root (SKILL.md). 4. Sanitization: The skill does not validate or sanitize content ingested from the workspace before processing it.
Audit Metadata