dt-coaching-foundation

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • Command Execution: The skill contains instructions to execute local scripts (Invoke-PptxPipeline.ps1 and invoke-pptx-pipeline.sh) for generating PowerPoint artifacts. This execution is gated by user requests or explicit activation within the coaching workflow and includes runtime checks to ensure compatibility with the active shell environment.
  • System Configuration Management: The instructions describe a protocol for detecting and addressing an incompatible PowerShell version. This process is designed to be transparent, requiring explicit user approval before initiating any environment updates.
  • Data Management and Persistence: Project progress and coaching state are maintained in a specific directory structure (.copilot-tracking/dt/{project-slug}/). This localized storage is used for session recovery and tracking method transitions without accessing sensitive system locations.
  • Indirect Prompt Injection Surface: As a coaching tool, the skill ingests user-provided Design Thinking evidence to generate canonical documents and presentation slides. While this represents a data processing surface, the instructions include validation checklists and specific template frameworks (such as the 'Problem Statement' generator) that structure how this information is handled.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 10:57 AM