cpo-advisor

Pass

Audited by Gen Agent Trust Hub on May 6, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides strategic advice and local analytical tools. All executable scripts (pmf_scorer.py, portfolio_analyzer.py) use standard Python libraries and perform calculations on structured JSON data without network or shell access.
  • [INDIRECT_PROMPT_INJECTION]: The skill contains an ingestion surface where the agent processes user-provided JSON data through its analytical scripts.
  • Ingestion points: pmf_scorer.py and portfolio_analyzer.py read user-defined JSON files via the --input argument.
  • Boundary markers: The skill does not implement explicit boundary markers or 'ignore' instructions for the processed data, as the scripts expect numerical and categorical inputs.
  • Capability inventory: The scripts are restricted to file reading and standard mathematical operations. No subprocess, network, or environment access is present.
  • Sanitization: The scripts use the standard json.load() library, which safely parses structured data into Python dictionaries without executing content.
Audit Metadata
Risk Level
SAFE
Analyzed
May 6, 2026, 01:52 AM
Security Audit — agent-trust-hub — cpo-advisor