tw-stu-learning-portfolio
Pass
Audited by Gen Agent Trust Hub on Apr 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute a local Python script (generate_portfolio.py) for processing student input into Word documents. - [COMMAND_EXECUTION]: User-provided text is passed as a command-line argument to the Python script. The instruction template uses double quotes for the
--contentflag, which is a standard practice to mitigate shell injection risks. - [SAFE]: Integrates with well-known services such as Canva and Google Drive through MCP connectors to facilitate document design and cloud storage.
- [SAFE]: Accesses educational materials via relative paths (
../../) and absolute system paths (/mnt/skills/), which is expected behavior for curriculum-aligned tools operating within a managed environment.
Audit Metadata