okr-planner
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [SAFE]: The skill acts as a specialized assistant for business planning, specifically for generating Objectives and Key Results (OKRs). All operations, including data distillation and workbook creation, are performed within the scope of intended business utility.
- [NO_CODE]: The skill consists entirely of instructional markdown and metadata. It does not include any scripts, executables, or code snippets that would require execution in a shell or runtime environment.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted user input (team directions, annual goals, etc.) and interpolate this information into a structured Excel workbook.
- Ingestion points: User-provided goal descriptions, annual directions, and cycle information are processed in the workflow (SKILL.md).
- Boundary markers: The instructions do not define specific delimiters or instructions for the agent to ignore potentially malicious embedded commands within the user's source material.
- Capability inventory: The agent uses spreadsheet tools to generate, title, and format Excel workbooks (OKR, Alignment, and Review log sheets).
- Sanitization: No explicit validation or sanitization steps are defined for the user-supplied text before it is inserted into the workbook fields. However, the rigid structure (e.g., 3-5 objectives, qualitative sentences only) provides significant natural mitigation against complex injection attacks.
Audit Metadata