cs-onboard
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion point for untrusted user input which is then persisted to a shared context file (
~/.claude/company-context.md). This context is explicitly intended to be consumed by other 'C-suite advisor' skills, creating a potential for cross-skill prompt injection attacks. - Ingestion points: Untrusted data is collected via the interactive founder interview commands
/cs:setupand/cs:updateas described inSKILL.mdand the interview craft guide inreferences/interview-guide.md. - Boundary markers: Absent. The output template
templates/company-context-template.mdlacks delimiters or specific instructions to the model to ignore potential instructions or commands embedded within the captured user values. - Capability inventory: The skill uses file-writing capabilities to create and update
~/.claude/company-context.mdon the local filesystem. - Sanitization: Absent. There is no evidence of content validation, escaping, or filtering before writing the user-provided responses to the persistent context file.
Audit Metadata