manpower
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions and scripts (radar_chart.py) require the installation of matplotlib and numpy for data visualization purposes.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses user session logs stored in ~/.claude/projects/ to extract prompting history. This data is processed locally to generate AI skill assessments and is not sent to external servers.
- [COMMAND_EXECUTION]: The skill workflow involves the execution of local Python scripts (score_calculator.py and radar_chart.py) to automate data processing and chart generation.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user session history for analysis. Ingestion points: Reads JSONL session logs from ~/.claude/projects/ (scripts/score_calculator.py). Boundary markers: None defined for the manual LLM evaluation phase. Capability inventory: Execution of local Python scripts for file writing and image generation. Sanitization: score_calculator.py implements regular expression filtering to remove system tags (, , etc.) and isolate user-supplied arguments from tool-generated content.
Audit Metadata