onboarding-checklist
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user inputs to generate client documentation, which is a common vulnerability surface.
- Ingestion points: Ingests user-supplied data regarding client profiles, services, team composition, and tech stacks in
SKILL.md. - Boundary markers: Absent; the instructions do not provide delimiters or clear guidance to the agent to treat user input as non-instructional data.
- Capability inventory: The skill utilizes the
Writetool to output the final markdown document to the local filesystem. - Sanitization: No input validation, escaping, or filtering is specified for the data collected from the user.
- [NO_CODE]: The skill consists solely of instructions and reference markdown files, containing no executable scripts, binaries, or external code dependencies.
Audit Metadata