business-plan-generator
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow involves generating a Python script based on user input and executing it to create a PowerPoint file. This is the intended functional behavior for generating structured documents.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it interpolates user-provided text into a Python script that is subsequently executed.
- Ingestion points: Business plan information provided by the user in response to the Step 1 questionnaire (SKILL.md).
- Boundary markers: None identified.
- Capability inventory: Execution of locally generated Python scripts via the environment's interpreter.
- Sanitization: Not specified in the instructions; the agent is responsible for safely handling user strings during code generation.
- [EXTERNAL_DOWNLOADS]: The skill relies on the python-pptx library, which is a standard community package for programmatically creating PowerPoint files.
- [SAFE]: Analysis of the instructions and the provided script template revealed no malicious intent, data exfiltration patterns, credential harvesting, or unauthorized network operations. The author references a related tool for HTML conversion (wulaosiji/skills/BP_to_HTML), which is a vendor-owned resource.
Audit Metadata