product-experience-officer

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill is designed to automatically identify and execute project entry points such as package.json scripts, install.sh, docker-compose.yml, and python entry points to facilitate live product walkthroughs.
  • Evidence: Found in SKILL.md under 'Mode B — run it yourself'.
  • Mitigation: The instructions explicitly command the agent to refuse any writes that touch pre-existing user data and to use temporary directories for testing.
  • [DATA_EXFILTRATION]: To perform its expert diagnosis phase, the skill reads local project files including source code, documentation, and configuration files like .claude/launch.json.
  • Evidence: SKILL.md instructions for Phase 2 ('Diagnose') and Mode B entry point discovery.
  • [PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection because it ingests untrusted data from the product's UI (via browser automation), terminal output, and source code while maintaining high-privilege capabilities like command execution.
  • Ingestion points: Product source code, screenshots, and live UI elements (SKILL.md).
  • Boundary markers: The methodology uses two phases to separate zero-context experience from expert diagnosis, though it lacks explicit delimiters for untrusted content.
  • Capability inventory: Shell execution, file system access, browser automation, and computer-use tools (SKILL.md).
  • Sanitization: Instructions mandate declining writes to user data and simulating fresh states in temporary directories.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 06:00 AM
Security Audit — agent-trust-hub — product-experience-officer