skill-quality-dashboard
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/check.pyutilizes thesubprocess.runmethod to invoke internal validation tools and the aggregator script. These operations are performed using a fixed list of arguments and absolute file paths derived from the skill's directory structure, preventing command injection or execution of arbitrary code. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted JSON data from the
docs/public/generated-reports/directory to generate its summary. While this provides a surface for indirect prompt injection, the skill treats the input as structured data and does not perform any security-sensitive operations based on the content of these reports. - Ingestion points:
docs/public/generated-reports/*.jsonread byaggregate_reports.py. - Boundary markers: None explicitly present in the data processing logic.
- Capability inventory: Limited to local file reads and standard output printing.
- Sanitization: Uses standard
json.loadsfor parsing, ensuring data is processed as a dictionary rather than executable code.
Audit Metadata