saas-metrics-calculator
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill incorporates a local Python script
scripts/check-output.pydesigned to validate that generated deliverables contain required SaaS metric terminology. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-supplied financial metrics, creating a potential surface for indirect prompt injection via the provided data.
- Ingestion points: Financial inputs (MRR, churn, customers) collected in Phase 1 of the metric calculation process (SKILL.md).
- Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands embedded in the user-provided data.
- Capability inventory: The skill references and uses a local script for deliverable validation (
scripts/check-output.py). - Sanitization: No specific input validation or sanitization logic is provided for the raw metric data inputs.
Audit Metadata