saas-metrics-coach
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied financial data and passes it as arguments to local Python scripts, creating a potential injection surface.\n
- Ingestion points: User-provided business metrics (MRR, churn, spend) collected in SKILL.md.\n
- Boundary markers: Absent; no delimitation or 'ignore' instructions are provided in the prompt structure.\n
- Capability inventory: Shell command execution via python for metrics_calculator.py, quick_ratio_calculator.py, and unit_economics_simulator.py.\n
- Sanitization: Absent; the skill does not instruct the agent to sanitize or escape user input before interpolation into CLI commands, though the Python scripts themselves cast inputs to float types.\n- [COMMAND_EXECUTION]: The skill makes extensive use of the python CLI to run calculations through scripts provided in the scripts/ directory.\n- [DYNAMIC_EXECUTION]: The skill relies on executing local Python scripts at runtime to perform its primary functionality, which is a standard but noteworthy execution pattern.
Audit Metadata