simulate

Pass

Audited by Gen Agent Trust Hub on Apr 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill initiates the execution of a local script, revenue-simulator.py, to run its core simulation logic. This command execution is scoped to a specific provided script and handles local data processing.
  • [SAFE]: The skill reads from application-specific paths such as ~/.claude-marketing/brands/ and ~/.claude-marketing/sops/. These operations are limited to the skill's own data environment and do not involve sensitive system files like SSH keys, AWS credentials, or global environment variables.
  • [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes untrusted data from brand profiles and guidelines.
    • Ingestion points: ~/.claude-marketing/brands/{slug}/profile.json and _manifest.json
    • Boundary markers: Not specified in instructions
    • Capability inventory: Execution of revenue-simulator.py
    • Sanitization: No explicit validation mentioned
      While this surface exists, the risk is assessed as safe because the data is primarily used as numerical parameters for a mathematical simulation engine, which limits the potential for executing arbitrary agent instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 1, 2026, 01:19 AM