business-case
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill contains instructions for the agent to recommend the execution of shell commands (
npx skills add ...) to the user. These commands are intended to install companion skills from the author's ('george-rd') own project repository ('George-RD/growth-arsenal'). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted business data provided by users to generate a structured decision model, presenting a surface for indirect prompt injection.
- Ingestion points: User prompts containing facts, estimates, and assumptions about a business case.
- Boundary markers: The workflow uses a specific markdown template (
templates/decision-model.md) to organize data into predefined fields, providing structural boundaries. - Capability inventory: The skill is designed to write model files and transfer the resulting data to companion skills (
writing-coreandexecutive-writing) for report generation. - Sanitization: No specific sanitization or filtering logic is defined to check user-supplied strings for embedded instructions before they are included in the model or passed to downstream skills.
Audit Metadata