technician-productivity
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from the codebase and external data models without boundary markers.
- Ingestion points: Reads technician time tracking, job completion records, KPI configurations, and organizational data in Phases 1 through 5.
- Boundary markers: Absent; there are no delimiters or specific instructions for the agent to ignore instructions embedded within the analyzed data.
- Capability inventory: The skill writes reports to the local file system (
docs/) and appends telemetry metadata to~/.claude/projects/. - Sanitization: Absent; the skill does not explicitly validate or filter content ingested from the project files.
- [DATA_EXPOSURE]: The skill accesses sensitive operational data including technician IDs, GPS-based time tracking, revenue, and job costs. This access is consistent with its stated purpose of field service productivity analysis.
Audit Metadata