gsc-ai-performance
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script gsc-ai-performance.py with arguments derived from brand context and file system paths. This automated script execution is a core feature but involves local code execution.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses sensitive brand-specific configuration and profile files located in the ~/.claude-marketing/ directory.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from a user-provided CSV file (02-export.csv). 1. Ingestion points: Data is read and processed in the script output generation step. 2. Boundary markers: No explicit markers are present to delimit untrusted data. 3. Capability inventory: The skill can execute local scripts and perform file writes. 4. Sanitization: No sanitization of the CSV data is specified before it enters the agent context.
Audit Metadata