weekly-performance-advisor
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references installation via
npx skills add, targetingLaGrowthMachineon GitHub. As this is the verified author of the skill, these downloads are considered safe and part of the intended installation flow. - [DATA_EXFILTRATION]: No evidence of unauthorized data transmission. The skill explicitly states it only pulls the user's live data via MCPs and renders it locally as an artifact. There are no hardcoded API keys or external 'collector' URLs.
- [COMMAND_EXECUTION]: The README suggests standard CLI commands for installation (
npx,sh,git clone). These are standard for developer tools and involve no obfuscation or suspicious redirection. - [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes a
!-style command mechanism viarunScheduledTaskfor its dashboard refresh functionality. This is gated by user consent (Phase 4.5) and uses a tool-provided task ID to re-run the skill's own logic rather than arbitrary shell commands. - [PROMPT_INJECTION]: The skill contains 'hard rules' for its own behavior but does not attempt to override the underlying agent's safety guidelines or core identity. The instructions are focused on deterministic data processing and rendering.
- [CREDENTIALS_UNSAFE]: The skill uses browser-based OAuth via the MCP and explicitly instructs the user that no API keys are required, following security best practices.
Audit Metadata