qbr-deck-builder
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates by requesting user-provided data and organizing it into a pre-defined template. Its primary action is generating markdown text and writing it to a specific local file path (
clients/<client-name>/...), which is consistent with its stated purpose of building decks for customer success teams. - [PROMPT_INJECTION]: The skill is designed to ingest untrusted data in the form of customer "verbatim comments" and "customer voice" quotes for use in slides. This presents a surface for indirect prompt injection if the ingested text contains instructions designed to manipulate the agent. However, this is an inherent risk of data synthesis tasks and not a malicious feature of the skill itself. Users are encouraged to provide data from verified sources.
- [DATA_EXFILTRATION]: While the skill processes sensitive business information (MRR, NPS, and usage stats), it does not contain network operations or code that attempts to transmit this data to external servers. The output is confined to the local filesystem.
Audit Metadata