lab-management
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses the '~/.claude/projects/' directory to record execution telemetry in 'skill-telemetry.md'. Interacting with hidden tool-specific configuration directories poses a data exposure risk.
- [PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface as it ingests untrusted codebase and laboratory inventory data to produce reports without sufficient isolation.
- Ingestion points: Read operations on project codebase and laboratory inventory data structures.
- Boundary markers: Absent; the instructions do not use delimiters or warnings to isolate untrusted data.
- Capability inventory: The skill has file-write capabilities (e.g., creating 'docs/lab-management-analysis.md').
- Sanitization: Absent; no validation or escaping of ingested external content is performed.
Audit Metadata