skills/konglong87/superpm/pm-clarify/Gen Agent Trust Hub

pm-clarify

Pass

Audited by Gen Agent Trust Hub on Aug 3, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute a local shell script (check-update.sh) for version management and uses standard shell commands (mkdir) to initialize a project directory structure. These actions are performed using the local file system and are consistent with the skill's stated purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for spawning subagents to conduct 'Market Benchmarking Analysis.' This creates a surface for indirect prompt injection because the agent may ingest untrusted data from external market research sources.
  • Ingestion points: External market data and benchmarking results fetched by subagents (Agent 1).
  • Boundary markers: None explicitly defined in the subagent prompts to isolate fetched content.
  • Capability inventory: The skill possesses Read, Write, and Bash capabilities, which are used to document requirements based on analyzed data.
  • Sanitization: No specific sanitization or filtering logic is provided for the external data before it is incorporated into the confirmation requirements list.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 3, 2026, 06:20 AM
Security Audit — agent-trust-hub — pm-clarify