quality-report
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions involve executing a local script
scripts/quality-tracker.pywith various sub-commands (get-trends, get-summary, check-regression, get-best, get-worst). This is used to process evaluation data and generate time-series reports. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it ingests data from external sources including brand profiles, agency SOPs, and rubrics to inform its analysis and recommendations.
- Ingestion points: Reads files from
~/.claude-marketing/brands/,~/.claude-marketing/sops/, andskills/context-engine/eval-rubrics.md. - Boundary markers: None identified; external content is integrated directly into the analysis process.
- Capability inventory: Subprocess execution via
scripts/quality-tracker.py. - Sanitization: No explicit sanitization or validation of ingested file content is mentioned.
Audit Metadata