linkedin-post-analytics-coach
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill performs its stated function using transparent instructions and a bundled Python script. The script,
analyze-linkedin-post-export.py, is restricted to Python's standard library and performs no network operations or unauthorized file access. The installation and workflow steps are consistent with standard AI agent skill patterns. - [INDIRECT_PROMPT_INJECTION]: The skill processes external LinkedIn post text and analytics XLSX files. Ingestion points: User-provided text content and analytics export files described in SKILL.md. Boundary markers: The agent is instructed to use specific structured templates and separate evidence from interpretation. Capability inventory: The skill uses a local script for file parsing; no network or file-write capabilities are present in the script. Sanitization: The script uses regex to sanitize numerical metrics and handles XML parsing via the standard library. This surface is considered safe given the skill's purpose and restricted execution environment.
- [COMMAND_EXECUTION]: The skill requires the agent to execute a local Python script to process analytics files. This command execution is localized to the skill's own provided script and is a functional requirement for data parsing.
Audit Metadata