simulate
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill initiates the execution of a local script,
revenue-simulator.py, to run its core simulation logic. This command execution is scoped to a specific provided script and handles local data processing. - [SAFE]: The skill reads from application-specific paths such as
~/.claude-marketing/brands/and~/.claude-marketing/sops/. These operations are limited to the skill's own data environment and do not involve sensitive system files like SSH keys, AWS credentials, or global environment variables. - [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes untrusted data from brand profiles and guidelines.
- Ingestion points:
~/.claude-marketing/brands/{slug}/profile.jsonand_manifest.json - Boundary markers: Not specified in instructions
- Capability inventory: Execution of
revenue-simulator.py - Sanitization: No explicit validation mentioned
While this surface exists, the risk is assessed as safe because the data is primarily used as numerical parameters for a mathematical simulation engine, which limits the potential for executing arbitrary agent instructions.
- Ingestion points:
Audit Metadata