product-lifecycle
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill serves purely as an orchestration layer, providing a routing table and handoff protocols between other AI agent skills. It contains no executable code (Python, JavaScript, or Shell).
- [EXTERNAL_DOWNLOADS]: The skill does not perform any network operations or download external resources. All referenced skills are expected to be available locally within the agent's environment.
- [DATA_EXFILTRATION]: There is no evidence of network-based exfiltration. The skill facilitates a 'lifecycle evidence ledger' which is a local file-based handoff mechanism intended for legitimate state management between product phases.
- [PROMPT_INJECTION]: The instructions in
SKILL.mdandAGENTS.mdare focused on operational routing and do not attempt to override the AI's core safety constraints or system prompts. - [INDIRECT_PROMPT_INJECTION]: While the skill defines ingestion points for untrusted data (e.g., 'Product idea' or 'Stakeholder request' in
references/phases.md), the skill itself does not perform high-risk actions likeeval()or network requests. The attack surface is minimal as it delegates processing to specialized child skills.
Audit Metadata