saas-metrics-coach
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a calculator for user-provided business data, which inherently involves an attack surface for indirect prompt injection via the ingested financial figures.
- Ingestion points: User-supplied revenue, customer counts, and marketing costs collected as described in
SKILL.mdandassets/input-template.md. - Boundary markers: No specific delimiters or boundary markers are instructed for the agent to use when interpreting the user data.
- Capability inventory: The skill invokes local Python scripts (
scripts/metrics_calculator.py,scripts/quick_ratio_calculator.py, andscripts/unit_economics_simulator.py) to process the data. - Sanitization: The Python scripts utilize
argparsefor CLI inputs andfloat()casting for interactive inputs, which serves as a basic validation layer to prevent non-numeric payloads from affecting the script execution logic. - [SAFE]: The skill uses only the Python standard library (json, sys, argparse) and contains no external dependencies or network-based exfiltration patterns. All references point to local files or the developer's public code repository.
Audit Metadata