signup-flow-cro
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions and reference materials provide standard conversion rate optimization (CRO) advice and templates without any malicious directives or obfuscation.
- [SAFE]: The provided Python script (
scripts/funnel_drop_analyzer.py) uses only Python standard libraries (json,math,argparse,sys) and performs local data processing and metric calculation. It does not perform network operations, file writes, or dynamic code execution. - [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to read context from
.claude/product-marketing-context.md. While this is an ingestion point for potentially untrusted data, the skill lacks any dangerous capabilities (such as shell execution or network requests) that could be exploited via this vector. Findings are assessed as safe. - Ingestion points:
.claude/product-marketing-context.md(Markdown) and funnel data viafunnel_drop_analyzer.py(JSON). - Boundary markers: The skill instructs the agent to use the context specifically for product marketing information.
- Capability inventory: The skill is limited to information retrieval and basic data processing via a provided script. No subprocess calls, file writes, or network operations are present in the scripts.
- Sanitization: The Python script performs basic validation on the structure and values of the input JSON data.
Audit Metadata