chief-of-staff
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill orchestrates complex workflows by passing user-supplied 'founder questions' to a network of 28 specialized sub-skills. This architecture is susceptible to indirect prompt injection where malicious instructions in the user input could influence the downstream agents.\n
- Ingestion points: User-provided questions passed through the
[INVOKE:role|question]syntax inSKILL.md.\n - Boundary markers: The skill lacks explicit isolation or instructions for sub-agents to disregard instructions embedded within the user questions.\n
- Capability inventory: The skill can invoke numerous specialized advisory skills and perform writes to the local file system.\n
- Sanitization: No sanitization or validation of user input is implemented before it is passed to other components.\n- [DATA_EXFILTRATION]: The skill writes session outcomes and decisions to
~/.claude/decision-log.md. While intended for record-keeping, this practice records data derived from the interaction to the local disk.
Audit Metadata