quality-risk-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external product requirements, change scopes, and evidence data. While this creates a surface for indirect prompt injection, the risk is mitigated by explicit instructions to separate confirmed facts from assumptions and the lack of dangerous tool capabilities (such as network requests or filesystem modifications). The skill acts solely as an information processor producing markdown output.
- [COMMAND_EXECUTION]: The skill contains a Python script (
evals/fixtures/check_domain_decisions.py) and a Bash script (evals/fixtures/check-domain-decisions.sh) intended for automated output validation during testing. These scripts utilize standard libraries to parse markdown tables and do not execute external code or interact with sensitive system resources. - [EXTERNAL_DOWNLOADS]: The skill references the author's official GitHub repositories and the PolyForm Project license website in its metadata and evaluation cases. These references are used for documentation and identifying test artifacts, and do not involve runtime downloading of executable content from untrusted sources.
Audit Metadata