vpe-review
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses Python to run local scripts located at relative paths within the repository (e.g.,
../../../skills/vpe-advisor/scripts/delivery_throughput_analyzer.py). This is a standard method for modularizing functionality across skills and does not involve remote code or untrusted sources. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from JSON files (
sprint_metrics.json,funnel.json, andteam.json). While this provides an ingestion point for external data, the process is local and structured. 1. Ingestion points: Data files passed to analysis scripts in the workflow section of SKILL.md. 2. Boundary markers: None explicitly provided in the markdown instructions. 3. Capability inventory: Execution of local Python scripts for data processing. 4. Sanitization: Relies on internal script logic for JSON parsing and validation.
Audit Metadata