feature-usage-adoption-scorer
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external structured data (JSON/CSV), which represents a potential surface for indirect prompt injection if the processed content contains malicious instructions intended for the agent.
- Ingestion points: The
run.pyscript reads data from a file path specified by the--inputcommand-line argument. - Boundary markers: No delimiters or specific instructions to ignore embedded instructions are present in the reference scaffold.
- Capability inventory: The script performs file system read and write operations (
pathlib.Path.read_textandpathlib.Path.write_text) based on provided arguments. - Sanitization: No input validation or content sanitization is implemented in this scaffold; it assumes the input is valid JSON.
- [SAFE]: The skill follows standard command-line interface patterns for data processing. No network operations, credential access, obfuscation, or persistence mechanisms were detected. The scripts use only Python standard library modules.
Audit Metadata