goal-tracker
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local commands through a tracker utility located at
/root/clawd/trackerto manage state, log activity, and update financial metrics. It also invokes/root/clawd/goal-tracker/generate-dashboardto create HTML visualizations. These commands are integral to the skill's purpose of goal management. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes external data from JSON files that could potentially contain instructions.
- Ingestion points: Reads data from
data/goals.jsonanddata/daily-log.json(SKILL.md). - Boundary markers: Absent; the skill does not specify the use of delimiters or 'ignore' instructions for the data it processes.
- Capability inventory: The skill has the ability to execute shell commands and write to the local file system (e.g., generating
index.html). - Sanitization: Absent; there is no documented validation or escaping of the contents within the JSON data files.
Audit Metadata