survey-analysis
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the processing of untrusted survey data.
- Ingestion points: The skill ingests data from
$ARGUMENTS, local codebase files, and response datasets (Qualtrics, SurveyMonkey exports, etc.) as defined in Phase 1. - Boundary markers: Absent. There are no instructions to the agent to distinguish between data and instructions within the processed survey responses.
- Capability inventory: The skill has the capability to read any file in the project, write a markdown report to
docs/survey-analysis-report.md, and append metadata to~/.claude/projects/skill-telemetry.md. - Sanitization: Absent. The skill does not implement filtering or validation of the ingested survey data before processing it for statistical or sentiment analysis.
- [NO_CODE]: The skill consists entirely of natural language instructions within the SKILL.md file and does not include any accompanying scripts or executable binaries.
- [COMMAND_EXECUTION]: The skill instructs the agent to search for a project memory directory at
~/.claude/projects/and append execution telemetry. While this is used for metadata logging, it represents an operation on a hidden directory outside the immediate project root.
Audit Metadata