product-metrics
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill lists shell commands (e.g.,
npx skills add pedroromeroluna/ai-first-product-skills) in its documentation. These are presented as manual installation instructions for the user to expand the skill pack and are not executed automatically by the skill's logic. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from previously generated research files (Discovery Briefs) within the project's research directory. While this represents an ingestion surface for untrusted content, the skill uses this data specifically to populate a Metric Brief without performing high-risk operations like network exfiltration or dynamic code execution.
- [DATA_EXPOSURE]: The skill reads from and writes to the local filesystem (specifically within
research/directories). These operations are restricted to the documented purpose of maintaining a repository of product research and are consistent with standard agent development workflows.
Audit Metadata