needscope
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices by implementing a structured workflow that includes 'Gate' rules for sanitizing and validating data. It explicitly separates untrusted external data (social media comments) from internal processing logic using 'Contract Chains' and quality audits.
- [COMMAND_EXECUTION]: The repository contains a Node.js validation script (
scripts/validate_contract_chain.mjs) and a legacy Python report generator (references/archive/generate_report_html.legacy.py). Analysis confirms these scripts perform standard local file system operations and data processing without unsafe command injection, remote code execution, or network exfiltration. - [PROMPT_INJECTION]: The skill is designed to process untrusted social media text. However, it incorporates specific 'Object-Related Filters' and 'Quality Gates' (Step 3 and Step 5) to categorize and filter input data, effectively mitigating the risk of indirect prompt injection by ensuring that only verified, brand-related signals influence the final AI analysis and report generation.
Audit Metadata