kano-model
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data, such as feature requests, roadmap candidates, and survey responses provided by the user.
- Ingestion points: The 'Domain Context' section specifies that the skill processes candidate product features, service attributes, customer needs, and roadmap ideas supplied by the user.
- Boundary markers: The skill provides a structured template (KANO ANALYSIS) and classification rules (Must-be, Performance, Attractive, etc.) which act as logical boundaries, though they do not explicitly sanitize input for prompt injection.
- Capability inventory: The skill utilizes the 'Read' and 'Grep' tools for data processing. It does not possess high-risk capabilities like shell execution or network writing.
- Sanitization: No explicit sanitization or filtering of user-supplied feature descriptions or survey data is defined.
- [EXTERNAL_DOWNLOADS]: The skill references several external URLs for subject matter grounding and source tracking.
- Targets: Grounding sources include professional and academic domains such as asq.org (American Society for Quality), jstage.jst.go.jp, and cir.nii.ac.jp. The source repository is hosted on the author's GitHub account (jacob-balslev/skill-graph).
- Status: These downloads and references are from well-known services or are vendor-owned resources and do not represent a security risk.
Audit Metadata