product-experience-officer
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to automatically identify and execute project entry points such as
package.jsonscripts,install.sh,docker-compose.yml, and python entry points to facilitate live product walkthroughs. - Evidence: Found in SKILL.md under 'Mode B — run it yourself'.
- Mitigation: The instructions explicitly command the agent to refuse any writes that touch pre-existing user data and to use temporary directories for testing.
- [DATA_EXFILTRATION]: To perform its expert diagnosis phase, the skill reads local project files including source code, documentation, and configuration files like
.claude/launch.json. - Evidence: SKILL.md instructions for Phase 2 ('Diagnose') and Mode B entry point discovery.
- [PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection because it ingests untrusted data from the product's UI (via browser automation), terminal output, and source code while maintaining high-privilege capabilities like command execution.
- Ingestion points: Product source code, screenshots, and live UI elements (SKILL.md).
- Boundary markers: The methodology uses two phases to separate zero-context experience from expert diagnosis, though it lacks explicit delimiters for untrusted content.
- Capability inventory: Shell execution, file system access, browser automation, and computer-use tools (SKILL.md).
- Sanitization: Instructions mandate declining writes to user data and simulating fresh states in temporary directories.
Audit Metadata