skills/microsoft/hve-core/ux-coaching/Gen Agent Trust Hub

ux-coaching

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • Indirect Prompt Injection Surface: The skill is designed to analyze and process various external inputs, including documents, transcripts, and stakeholder quotes, which could potentially contain untrusted content. To address this, the instructions in SKILL.md specifically direct the agent to treat all such materials strictly as data and to inform the user if any embedded instructions are detected.
  • Local State Management: The skill maintains session continuity by reading and writing state information to a dedicated local directory. As described in references/coaching-state.md, this process follows a defined schema and includes explicit constraints against recording personal identifiers, supporting privacy and data integrity.
  • Use of Trusted External References: The coaching methodologies are grounded in documentation from official and well-known organizations, such as Microsoft and the UK Government. These references, found in the moment-specific files in the references directory, are used solely for informational grounding and do not involve any remote execution or unauthorized data transmission.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 05:55 AM