north-star-metric
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructional content and a local Python tool (
metric_tree_builder.py) for managing project metrics. A thorough review of the code and instructions revealed no malicious patterns. - [COMMAND_EXECUTION]: The included Python script is used for text processing and formatting. It relies exclusively on the Python standard library and does not invoke external shell commands, spawn subprocesses, or perform network operations.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided metric data in JSON format. The Python tool includes sanitization for its outputs (e.g., HTML escaping for Confluence and string escaping for Mermaid) and does not treat input data as executable code, effectively mitigating injection risks.
- [DATA_EXFILTRATION]: There are no indicators of unauthorized data access or external transmission. The tool operates locally on provided input files and outputs to the console or specified local files.
Audit Metadata