cpo-advisor
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides strategic advice and local analytical tools. All executable scripts (
pmf_scorer.py,portfolio_analyzer.py) use standard Python libraries and perform calculations on structured JSON data without network or shell access. - [INDIRECT_PROMPT_INJECTION]: The skill contains an ingestion surface where the agent processes user-provided JSON data through its analytical scripts.
- Ingestion points:
pmf_scorer.pyandportfolio_analyzer.pyread user-defined JSON files via the--inputargument. - Boundary markers: The skill does not implement explicit boundary markers or 'ignore' instructions for the processed data, as the scripts expect numerical and categorical inputs.
- Capability inventory: The scripts are restricted to file reading and standard mathematical operations. No subprocess, network, or environment access is present.
- Sanitization: The scripts use the standard
json.load()library, which safely parses structured data into Python dictionaries without executing content.
Audit Metadata