product-skills
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
changelog_generator.pyutility requires thegitcommand to be available on the system path to extract repository commit history, which is a standard functional requirement for generating software release notes. - [INDIRECT_PROMPT_INJECTION]: The skill includes tools that ingest external data from CSV and TXT files (e.g.,
features.csvinrice_prioritizer.py,interview.txtincustomer_interview_analyzer.py) to perform analysis. While these ingestion points represent an attack surface for indirect prompt injection, the tools are scoped to deterministic Python scripts with limited system access, and the instructions focus on analytical output rather than autonomous decision-making. - [DYNAMIC_EXECUTION]: The
landing_page_scaffolder.pyandproject_bootstrapper.pyscripts generate project boilerplate and UI components based on user-provided configurations. This is a common template-based generation process for scaffolding new projects and is consistent with the skill's primary purpose.
Audit Metadata