goals-and-kpis
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The README.md file contains a one-line installation command that downloads a shell script from the author's public GitHub repository and pipes it directly to bash. This pattern is documented as a convenient installation method for the skill.
- [EXTERNAL_DOWNLOADS]: The skill documentation and installation scripts reference external resources hosted on well-known services, specifically GitHub and npm. These resources include the project's source code and installation scripts (@thierryteisseire/goals-and-kpis).
- [COMMAND_EXECUTION]: The skill includes automation scripts (install.js and install.sh) that are executed during the installation process via package.json scripts. These scripts perform necessary file system operations, such as creating directories in the agent's home folder and establishing symlinks, to integrate the skill into the local agent environment.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting user-provided business context and organizational data to generate strategic frameworks. This ingestion of untrusted data represents an attack surface for indirect prompt injection.
- Ingestion points: User-provided descriptions of company stage, team structure, and strategic challenges provided via the CLI.
- Boundary markers: The skill does not specify explicit boundary markers or delimiters for user-provided data.
- Capability inventory: The skill is scoped to use file system tools (Read, Write, Edit, Glob, Grep) and shell execution (Bash).
- Sanitization: No explicit sanitization or filtering of external input is implemented in the provided instruction files.
Audit Metadata