weekly-kpi-report-skill
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill employs the
bash datecommand to dynamically calculate the Monday-to-Friday reporting window for the current week. This is a benign use of system utilities to ensure report accuracy without requiring hardcoded dates. - [DATA_EXPOSURE]: The skill writes a summary of its execution to a JSON file in
~/.claude/skill-analytics/. This is a standard practice for telemetry and status tracking within the agent environment and does not involve the exfiltration of sensitive user data. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external CRM and calling platforms (HubSpot and Nooks). This is a necessary component of its primary reporting function. The skill focuses on extracting quantitative metrics (dials, connects, deal amounts), which significantly reduces the risk of malicious instructions embedded in the ingested data influencing agent behavior.
Audit Metadata