cmo-advisor

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Python scripts marketing_budget_modeler.py and growth_model_simulator.py located in the scripts/ directory. These tools are used for budget modeling and growth simulations as part of the skill's core functionality.
  • [PROMPT_INJECTION]: The skill is designed to ingest data from external files like company-context.md and through cross-role invocations. This represents a surface for indirect prompt injection where untrusted data could influence agent behavior. 1. Ingestion points: company-context.md, role invocation mechanism ([INVOKE:role|question]). 2. Boundary markers: Not explicitly defined for delimiting external data from system instructions. 3. Capability inventory: Reads local reference files and executes local python scripts. 4. Sanitization: No sanitization or filtering of external content is described.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 11:28 AM
Security Audit — agent-trust-hub — cmo-advisor