ai-governance-checklist
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill acts as a task-oriented coach providing instructional guidance for Metabase AI features without executing dangerous operations.
- [DATA_EXPOSURE]: The skill implements a persistence mechanism to save state to a local file at
./.claude/ai-governance-checklist/progress.json. This is standard practice for maintaining progress across sessions in agent environments. - [EXTERNAL_DOWNLOADS]: The skill references official documentation at
metabase.com. Metabase is a well-known technology service, and the reference is informational and targets a trusted vendor domain. - [INDIRECT_PROMPT_INJECTION]: The skill instructions define a potential attack surface where the agent ingests data from the Metabase MCP server, such as tool outputs from database queries and schema metadata. The instructions include boundary checks and mandate clear communication to the user regarding the limits of these tests, which serves as a defensive design pattern against accidental obedience to embedded instructions.
Audit Metadata