weekly-team-performance
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates on data pulled exclusively from the user's own La Growth Machine MCP tools (e.g., list_identities, get_campaign_stats), ensuring that the agent only accesses data it is authorized to see.
- [SAFE]: Instructions in the SKILL.md FILL CONTRACT explicitly mandate escaping all user-controlled text such as names and messages when rendering the dashboard artifact. This practice mitigates potential cross-site scripting (XSS) vulnerabilities in the agent's artifact or canvas surface.
- [SAFE]: Local data persistence for configuration and weekly snapshots is restricted to a dedicated project directory (./.wtp/), following standard local storage patterns.
- [SAFE]: External references, such as installation paths and companion skill links, point to the official vendor domain (lagrowthmachine.com) and verified GitHub repositories (LaGrowthMachine/gtm-system), which are consistent with the stated author identity.
- [SAFE]: The optional weekly refresh routine utilizes the agent platform's native task scheduling capabilities rather than attempting to implement unauthorized background persistence.
Audit Metadata