stelow-product-opportunity-mapping

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill contains a shell script snippet in the Entry (mode detection) section. This script checks for the existence of environment variables (STELOW_WORKFLOW, STELOW_STATE) to determine if it is running in 'workflow' or 'standalone' mode. The commands (echo) are benign and used for environment detection and logging.
  • [REMOTE_CODE_EXECUTION]: The skill references external Markdown files for tools like ask.md and web-research.md. These are referenced as 'contracts' or interfaces for the agent to follow, not as scripts to be downloaded and executed directly. This is standard behavior for modular AI agent skills.
  • [PROMPT_INJECTION]: While the skill uses strong instructional language (e.g., [CRITICAL INSTRUCTION], MUST be Markdown), these are used to enforce output formatting and quality for the intended purpose, not to bypass safety guidelines or override the agent's core instructions.
  • [DATA_EXFILTRATION]: There are no signs of sensitive file access or unauthorized network operations. The web-research tool is mentioned for gathering market evidence, which is consistent with the skill's primary function of strategic analysis.
  • [DYNAMIC_CONTEXT_INJECTION]: No !command`` patterns were found in the SKILL.md file.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 03:00 AM