trial-feedback
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a Python script (
scripts/review_trial.py) to process trial data. The script is invoked via a standard CLI pattern and performs deterministic calculations on JSON input provided via standard input. It does not spawn subshells, perform network requests, or access sensitive file system paths. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a data processor for trial observations and feedback notes. It includes specific mitigation instructions to prevent schema confusion and ensures the AI separates internal notes from candidate feedback.
- Ingestion points: Data enters via a JSON structure containing trial observations, support gaps, and settlement terms (
SKILL.mdstep 3). - Boundary markers: The instructions explicitly demand separating 'Manager Notes' from 'Candidate Feedback' (
references/debrief-method.md). - Capability inventory: The skill has no network access or file-write capabilities. It only generates text drafts for the user to review.
- Sanitization: The script validates JSON schema and types before processing.
- [SAFE]: The skill follows least-privilege principles by strictly limiting its scope to draft generation and explicitly forbidding the AI from performing high-privilege actions such as payment processing or sending communications on the user's behalf.
Audit Metadata