chief-of-staff
Pass
Audited by Gen Agent Trust Hub on Apr 5, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill serves as an orchestration layer that ingests untrusted user questions and business context to drive a multi-agent pipeline, creating a surface for indirect prompt injection. 1. Ingestion points: User questions and company context are processed in the SKILL.md Session Protocol. 2. Boundary markers: No delimiters or isolation instructions are present to separate untrusted content from internal logic. 3. Capability inventory: The skill can trigger other agent roles via cross-skill invocation using the [INVOKE] syntax and write to the local file system. 4. Sanitization: No input validation or filtering is implemented before routing data.
- [DATA_EXFILTRATION]: The skill records session metadata and sensitive executive decisions to a fixed local file at ~/.claude/decision-log.md, creating a persistent record of interaction history in a predictable location.
- [COMMAND_EXECUTION]: The custom orchestration syntax [INVOKE:role|question] allows user-influenced strings to programmatically trigger the execution of subordinate advisor skills. Although loop prevention is present, the logic enables user-controlled data to drive multi-step execution flows.
Audit Metadata