pvp-winrate-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [SAFE]: The skill follows security best practices by providing guidelines for quoting SQL identifiers to prevent injection and requiring explicit user confirmation before performing write operations or modifying the local environment.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface as it processes user-provided event and property names to construct analysis commands.
- Ingestion points: Event names, property names, and project IDs supplied in the 'Required Inputs' section.
- Boundary markers: The instructions guide the agent to use structured clarifications if names are unresolved.
- Capability inventory: Shell command execution via 'ae-cli' for data retrieval and export.
- Sanitization: Explicit instructions for quoting SQL identifiers containing special characters.
- [COMMAND_EXECUTION]: The skill utilizes a set of 'ae-cli' commands to interact with project data and metadata. These commands are integral to the skill's primary function of gaming data analysis.
- [DYNAMIC_EXECUTION]: The skill includes instructions for handling missing Python dependencies through isolated virtual environments, which is a standard development practice. The 'Failure Handling' section specifies asking the user before creating environments or downloading packages.
Audit Metadata