lovstudio-bp-polish

Pass

Audited by Gen Agent Trust Hub on Aug 3, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a bundled Python script (scripts/audit_bp.py) to perform structural and evidence hygiene checks on business plan outlines. The script uses only standard library modules and performs regex-based text analysis without any dangerous operations like eval() or subprocess calls.- [DATA_EXPOSURE]: The skill processes user-supplied business documents (PDF, PPTX, Markdown) to provide reviews. It follows a portable configuration contract that prioritizes relative paths and explicitly instructs against copying secrets into the workspace, as detailed in references/user-config.md.- [INDIRECT_PROMPT_INJECTION]: The skill processes external data (BPs and QR codes) which presents a potential surface for indirect prompt injection. However, the instructions in SKILL.md (Step 3: Protect facts during polishing) and the use of adversarial review lenses (Step 2) provide behavioral guardrails to ensure the agent maintains factual accuracy and ignores instructions embedded within the data being reviewed.- [EXTERNAL_DOWNLOADS]: The README.md references a version badge from img.shields.io, which is a well-known and trusted service for documentation metadata.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 3, 2026, 08:34 AM
Security Audit — agent-trust-hub — lovstudio-bp-polish