cn-severance-calculator
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes untrusted text from termination agreements and wage data provided by the user.
- Ingestion points: User-provided 'Average monthly wage' and 'Any agreement' text mentioned in SKILL.md are ingested into the agent context.
- Boundary markers: The instructions do not define clear delimiters or 'ignore embedded instructions' warnings for the ingested data.
- Capability inventory: The skill uses a subprocess call to execute the scripts/cn_severance.py Python script to generate the calculation.
- Sanitization: There is no evidence of sanitization or filtering for the external text content before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill includes a local Python script scripts/cn_severance.py which is executed via a command-line interface. Analysis shows the script only uses standard libraries (argparse, json, sys, datetime) and performs mathematical calculations without any network or file system operations. The execution is tied directly to the skill's primary purpose.
Audit Metadata