lovstudio-bp-polish
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled Python script (
scripts/audit_bp.py) to perform structural and evidence hygiene checks on business plan outlines. The script uses only standard library modules and performs regex-based text analysis without any dangerous operations likeeval()orsubprocesscalls.- [DATA_EXPOSURE]: The skill processes user-supplied business documents (PDF, PPTX, Markdown) to provide reviews. It follows a portable configuration contract that prioritizes relative paths and explicitly instructs against copying secrets into the workspace, as detailed inreferences/user-config.md.- [INDIRECT_PROMPT_INJECTION]: The skill processes external data (BPs and QR codes) which presents a potential surface for indirect prompt injection. However, the instructions inSKILL.md(Step 3: Protect facts during polishing) and the use of adversarial review lenses (Step 2) provide behavioral guardrails to ensure the agent maintains factual accuracy and ignores instructions embedded within the data being reviewed.- [EXTERNAL_DOWNLOADS]: TheREADME.mdreferences a version badge fromimg.shields.io, which is a well-known and trusted service for documentation metadata.
Audit Metadata