business-growth-skills
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or data exfiltration attempts were found. The skill focuses on business productivity and data analysis using local resources and provides legitimate templates for legal and commercial documents.
- [COMMAND_EXECUTION]: The instructions utilize shell commands to run local Python scripts (e.g.,
scripts/health_score_calculator.py) for processing JSON business data. It also uses standard shell piping and redirection to manage script output. - [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing
pandocvia standard package managers (brew,apt) to facilitate the conversion of contract templates from Markdown to DOCX format. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests and processes untrusted external data (JSON files) which could potentially contain malicious instructions.
- Ingestion points: Multiple JSON data files (e.g.,
assets/sample_customer_data.json,pipeline.json,competitive_data.json). - Boundary markers: Absent.
- Capability inventory: Subprocess execution (Python), file system access, and package management commands.
- Sanitization: No explicit sanitization or instruction-ignoring delimiters are provided in the prompts for handling data content.
Audit Metadata