Skills
Navigate
skills/romainsimon/skills-for-decision-making/allocating-effort/Gen Agent Trust Hub

allocating-effort

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions include steps to run a bundled Node.js script (scripts/calc.js) to perform allocation and comparison calculations. This is legitimate functionality for a data-processing skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external file (arms.json) to compute outcomes, which represents a potential attack surface. 1. Ingestion points: Data is loaded from arms.json in the allocate and compare workflows defined in SKILL.md. 2. Boundary markers: None are explicitly used to separate the input data from the prompt instructions. 3. Capability inventory: The skill has the ability to execute shell commands via the node runtime as described in SKILL.md. 4. Sanitization: There are no documented sanitization or schema validation steps for the input data provided in the instruction set.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 12:08 PM