cs-onboard
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) by collecting and persisting user-supplied data without sanitization.
- Ingestion points: User-provided interview responses are processed and stored by instructions in
SKILL.mdvia the/cs:setupand/cs:updatecommands. - Boundary markers: Although the output is structured using a template (
assets/company-context-template.md), there are no explicit boundary markers or instructions to the agent to ignore potentially malicious content within the captured data fields. - Capability inventory: The skill performs file-write operations to
~/.claude/company-context.md(SKILL.md), which is a persistent file intended to be read by other skills. - Sanitization: No validation, escaping, or filtering is performed on the input before it is written to the persistent context file.
- [COMMAND_EXECUTION]: The skill performs persistent file-system writes to the
~/.claude/directory to store sensitive company data, including revenue, runway, and internal organizational challenges. This persistent data collection creates a high-value target for other potentially malicious skills on the same system.
Audit Metadata