ceo-advisor
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes two Python scripts,
scripts/strategy_analyzer.pyandscripts/financial_scenario_analyzer.py, which are intended to be executed locally. These scripts perform mathematical modeling and data processing using standard libraries (json, math, datetime). No dangerous system calls, shell injections, or external network requests were found within the code. - [PROMPT_INJECTION]: The skill instructs the agent to read an external file,
company-context.md, to gain business context before responding. While this creates an attack surface for indirect prompt injection if the content of that file is untrusted, the skill does not possess high-risk capabilities (like automated network sending or file deletion) that could be easily weaponized. - Ingestion points:
company-context.md(referenced in SKILL.md). - Boundary markers: Not explicitly defined in the prompt instructions.
- Capability inventory: Execution of local Python scripts for financial modeling and strategy scoring.
- Sanitization: No explicit sanitization of the context file is described.
Audit Metadata