performance-review-360-peer
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by incorporating untrusted user input into its file management logic.
- Ingestion points: User-provided names for the feedback giver and receiver, and conversational feedback responses (Step 1 and Step 3 in
SKILL.md). - Boundary markers: None; the skill does not use specific delimiters or instructions to ignore potential commands embedded in the peer feedback text.
- Capability inventory: The skill performs file system read operations to list team members and write operations to save feedback files to the workspace (
SKILL.md). - Sanitization: Minimal; the instructions suggest basic formatting (lowercase, hyphens) but do not explicitly provide robust validation to prevent path traversal or the injection of malicious formatting into the generated markdown files.
Audit Metadata