onboarding-cro
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill is purely instructional and does not contain any malicious code or high-risk command execution patterns.
- [PROMPT_INJECTION]: No direct prompt injection, behavior overrides, or system prompt extraction attempts were identified in the instructions. The skill acknowledges a potential surface for indirect prompt injection by reading local product-marketing-context files; however, this is assessed as safe due to the total absence of exploitable capabilities. Mandatory Evidence Chain for Category 8: 1. Ingestion points: .agents/product-marketing-context.md (referenced in SKILL.md). 2. Boundary markers: Absent. 3. Capability inventory: No subprocess calls, file-write operations, or network requests identified across any skill files. 4. Sanitization: Absent.
- [DATA_EXFILTRATION]: No credential harvesting, hardcoded secrets, or unauthorized network operations were found. The skill lacks the tools necessary to transmit data externally.
- [COMMAND_EXECUTION]: No shell commands, privilege escalation patterns, or dynamic code execution mechanisms were detected in the skill scripts or instructions.
Audit Metadata