portfolio-dashboard
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill runs a local Python generator script (
generate-dashboard.py) and a bash utility (project-status.sh) to aggregate project metrics. These executions are performed with shell=False equivalents, preventing command injection. - [DATA_EXPOSURE]: The skill reads project-specific JSON files and metadata from the local workspace. This data access is consistent with the stated goal of generating a portfolio overview and no external exfiltration was detected.
- [SAFE]: The Python processing script implements defensive programming by sanitizing output strings and validating URL protocols (restricting to http, https, and mailto), which effectively mitigates cross-site scripting (XSS) risks from untrusted or malicious content within the project files.
Audit Metadata