grant-management
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. It is designed to ingest and analyze external codebase data, such as proposal records and budget structures, and incorporate findings into a generated report. There are no explicit boundary markers or sanitization steps mentioned to prevent malicious instructions within the analyzed data from influencing the agent's behavior.
- Ingestion points: Codebase files containing grant and award data (Phase 1).
- Boundary markers: Absent.
- Capability inventory: Local file writing to docs/grant-management-analysis.md.
- Sanitization: Absent.
- [SAFE]: The skill includes a Self-Evolution Telemetry mechanism that appends execution metadata to a local file in ~/.claude/projects/. This is a local logging function used for skill performance tracking and does not involve unauthorized data exfiltration or external network access.
Audit Metadata