skills/borghei/claude-skills/form-cro/Gen Agent Trust Hub

form-cro

Pass

Audited by Gen Agent Trust Hub on Apr 1, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: The skill instructions contain no patterns attempting to override agent behavior, bypass safety filters, or extract system prompts. The content is strictly limited to CRO methodology and instructional guidance.
  • [DATA_EXFILTRATION]: No network operations, hardcoded credentials, or sensitive file path access were detected. The scripts function entirely offline and do not transmit data to external servers.
  • [REMOTE_CODE_EXECUTION]: There are no patterns involving the download or execution of remote scripts. The skill relies exclusively on its included local Python scripts.
  • [COMMAND_EXECUTION]: The skill documents the use of its local scripts (form_scorer.py, field_cost_analyzer.py, ab_test_calculator.py) for data analysis. These scripts do not use dangerous functions like eval(), exec(), or subprocess for executing shell commands or arbitrary code.
  • [OBFUSCATION]: No obfuscated strings, Base64-encoded payloads, zero-width characters, or homoglyph attacks were found in the markdown or code files.
  • [INDIRECT_PROMPT_INJECTION]: While the skill processes external JSON data for analysis, it does not use this data in a way that could influence the agent's logic or trigger unsafe tool execution. The data is handled through standard JSON parsing and mathematical scoring logic.
  • [DYNAMIC_EXECUTION]: The provided Python scripts use only standard library modules (argparse, json, math, sys) and perform deterministic calculations. There is no runtime code generation or dynamic loading of untrusted modules.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 1, 2026, 01:08 AM