skills/codihaus/claude-skills/debrief/Gen Agent Trust Hub

debrief

Pass

Audited by Gen Agent Trust Hub on Mar 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Python script, scripts/generate_questionnaire.py, to generate Excel-based questionnaires. This is a core part of the skill's functionality and utilizes the openpyxl library.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by processing untrusted data from user-supplied files and local configuration graphs. Ingestion points: Processes plans/docs-graph.json, user-provided .xlsx files (via the --answers flag), and .pdf requirements documents. Boundary markers: No delimiters or specific instructions to ignore embedded commands were found in the templates or processing logic. Capability inventory: The skill has the ability to write files to the local plans/ directory and execute a local Python script. Sanitization: No evidence of sanitization or validation of the content extracted from external files was detected.
  • [EXTERNAL_DOWNLOADS]: The skill uses the WebSearch tool in Phase 2 to gather industry patterns and documentation links, which are saved to references.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 1, 2026, 08:41 PM