lifecycle-and-retention
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute a provided Node.js script (
retention.js) to perform churn, retention, and LTV calculations. This execution is limited to the skill's own local resources. - [EXTERNAL_DOWNLOADS]: The skill references external resources for benchmarking and documentation from well-known industry sources, including Bessemer Venture Partners and SaaS Capital, as well as the author's official consulting domain. These are informational references and do not involve remote code execution or automated downloads.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied business metrics (such as revenue movement and customer counts) through the
retention.jsscript to generate financial reports. - Ingestion points: User-provided JSON data is passed as a command-line argument to the
resources/retention.jsscript. - Boundary markers: The script expects structured JSON input, which naturally separates data from execution logic.
- Capability inventory: The script's functionality is strictly limited to mathematical computation and console output. It does not possess network access, file system write capabilities, or the ability to spawn subprocesses.
- Sanitization: The script implements JSON validation and checks input fields against a strict whitelist of expected keys and numeric data types before processing.
Audit Metadata