cto-advisor
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides structured guidance and analytical scripts for engineering management tasks. Technical analysis of the provided Python scripts confirms they use standard libraries (argparse, json, math, datetime) for data processing and do not perform network operations, file system modifications, or access sensitive credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection due to its design for processing external context files.
- Ingestion points: The skill instructs the agent to integrate information from
company-context.mdand user-supplied system metrics. - Boundary markers: The skill instructions do not define specific delimiters or security guardrails to isolate ingested context from core instructions.
- Capability inventory: The skill is limited to executing the provided local analysis scripts (
tech_debt_analyzer.pyandteam_scaling_calculator.py), which are restricted to analytical report generation. - Sanitization: No specific sanitization or validation logic is implemented for the external data ingested by the agent.
Audit Metadata