growth-hacking

Pass

Audited by Gen Agent Trust Hub on Apr 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to perform directory listings using the ls command on specific local paths (e.g., ~/.claude/skills/, ~/.agent/skills/) to identify if recommended companion skills are present.
  • [EXTERNAL_DOWNLOADS]: The documentation and instructions suggest that the user install components using npx from the AbsolutelySkilled/AbsolutelySkilled repository, which is a third-party source relative to the platform but consistent with the vendor's own infrastructure.
  • [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by ingesting and analyzing untrusted user data such as marketing metrics and funnel descriptions.
  • Ingestion points: User-provided AARRR metrics, cohort behavior data, and growth experiment details in SKILL.md and references/growth-frameworks.md.
  • Boundary markers: No specific delimiters or instructions to ignore embedded commands are used when processing this data.
  • Capability inventory: The agent possesses shell execution capabilities (used for ls).
  • Sanitization: No data validation or sanitization routines are specified for the incoming business data.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 7, 2026, 03:04 PM
Security Audit — agent-trust-hub — growth-hacking