goal-progress-bar
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses a local Python script (
scripts/progress.py) to process JSON tracker files. The script implements strict schema validation, ensuring that data types (strings, decimals) and values (weights, fractions) conform to expected ranges before rendering. It handles errors gracefully and uses standard libraries with no external dependencies. - [INDIRECT_PROMPT_INJECTION]: The skill processes external JSON data which is then rendered back to the agent. While this creates a potential surface for indirect prompt injection via the 'name' field, the script mitigates this by enforcing that names are single-line strings without tabs or newlines. Furthermore, the skill has no network access or file-writing capabilities, limiting the impact of any injected text to the agent's immediate conversational context.
- [COMMAND_EXECUTION]: The instructions direct the agent to execute a local Python script. The parameters passed to the script (filenames and titles) are handled as command-line arguments. The script itself does not spawn sub-processes or use
eval()/exec(), minimizing risks associated with shell injection.
Audit Metadata