product-operations-and-governance
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: The skill consists solely of Markdown documentation (
SKILL.md,README.md,references/discovery-brief.md), Markdown templates (templates/*.md), and an evaluation configuration (evals/evals.json). There are no scripts, executables, or code blocks that could be executed by the agent or host system. - [EXTERNAL_DOWNLOADS]: No external URLs or remote resources are referenced for download or execution. The skill is entirely self-contained within the provided files.
- [COMMAND_EXECUTION]: There are no shell commands, subprocess calls, or dynamic context injection patterns (
!command) detected in any of the files. - [DATA_EXFILTRATION]: No network operations (
curl,wget,fetch) or sensitive file access patterns are present. The skill operates purely on the provided governance framework. - [PROMPT_INJECTION]: The instructions in
SKILL.mdare descriptive and focus on guiding the agent's behavior within the product governance domain. There are no patterns attempting to bypass safety filters or override system-level instructions. - [INDIRECT_PROMPT_INJECTION]: While the skill involves processing user-provided information to fill templates (e.g., in
templates/decision-rights-map.md), it defines strict schemas for this information (accountable owners, evidence, roles) and lacks the automated capabilities (like writing to sensitive files or making network calls) that would make indirect injection a high-risk vector.
Audit Metadata