energy-efficiency
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill reads local project files including manifests and configurations to map energy management infrastructure. It also appends execution results to
skill-telemetry.mdwithin the~/.claude/projects/directory. These file operations are localized and support the skill's diagnostic and logging capabilities. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted codebase data (source code and manifests) without implementing boundary markers or instructions to disregard embedded commands. 1. Ingestion points: All files within the analyzed codebase (SKILL.md). 2. Boundary markers: None. 3. Capability inventory: File system read and write operations across the codebase and internal telemetry paths (SKILL.md). 4. Sanitization: No content escaping or validation is performed on the analyzed data.
Audit Metadata