onboarding-cro
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: A comprehensive analysis of the skill's instructions, metadata, and scripts revealed no evidence of malicious behavior, prompt injection, or data exfiltration.
- [PROMPT_INJECTION]: The skill instructs the agent to read context from
.claude/product-marketing-context.md. While this creates a surface for indirect prompt injection, it is a standard pattern for providing project-specific knowledge and poses minimal risk here. * Ingestion points:SKILL.md(Initial Assessment section). * Boundary markers: Absent. * Capability inventory:scripts/activation_funnel_analyzer.py(limited to standard library file reading and data processing; no network or write access). * Sanitization: Not explicitly defined in the skill logic. - [COMMAND_EXECUTION]: The skill includes
scripts/activation_funnel_analyzer.py, which is designed to analyze JSON funnel data. The script uses only standard Python libraries (json,sys,os) and does not contain dangerous functions for network access, file system modification, or dynamic code execution.
Audit Metadata