simulate-startup-sales
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill executes bundled Node.js scripts for managing session state and generating Markdown reports. These scripts are limited to local file system interactions within the workspace and do not contain network-enabled code, subprocess execution of external binaries, or dynamic evaluation of untrusted input.\n- [SAFE]: Comprehensive safety and integrity instructions are provided in 'references/sales-integrity.md' and 'references/scoring.md'. These rules strictly prohibit the agent from inventing product claims, certifications, or customer testimonials, and require all assessment scores to be cited with specific transcript turn IDs.\n- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface as it is designed to process external URLs, repositories, and workspace files for grounding.\n
- Ingestion points: Identified in
SKILL.mdin the 'Ground the startup' section.\n - Boundary markers: The instructions use semantic grounding rules (e.g., 'Record only supported... facts', 'Never invent...') rather than structural delimiters.\n
- Capability inventory: Local file read/write and execution of predefined Node.js scripts.\n
- Sanitization: The scripts implement JSON schema validation and HTML character escaping for Markdown output generation.
Audit Metadata