okr-planner

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
  • [SAFE]: The skill acts as a specialized assistant for business planning, specifically for generating Objectives and Key Results (OKRs). All operations, including data distillation and workbook creation, are performed within the scope of intended business utility.
  • [NO_CODE]: The skill consists entirely of instructional markdown and metadata. It does not include any scripts, executables, or code snippets that would require execution in a shell or runtime environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted user input (team directions, annual goals, etc.) and interpolate this information into a structured Excel workbook.
  • Ingestion points: User-provided goal descriptions, annual directions, and cycle information are processed in the workflow (SKILL.md).
  • Boundary markers: The instructions do not define specific delimiters or instructions for the agent to ignore potentially malicious embedded commands within the user's source material.
  • Capability inventory: The agent uses spreadsheet tools to generate, title, and format Excel workbooks (OKR, Alignment, and Review log sheets).
  • Sanitization: No explicit validation or sanitization steps are defined for the user-supplied text before it is inserted into the workbook fields. However, the rigid structure (e.g., 3-5 objectives, qualitative sentences only) provides significant natural mitigation against complex injection attacks.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 02:01 PM