curriculum-package-common-cartridge
Pass
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: LOW
Full Analysis
- SAFE (SAFE): No malicious indicators, such as prompt injection, hardcoded credentials, or exfiltration patterns, were found in the source code.
- INDIRECT_PROMPT_INJECTION (INFO): The skill ingests untrusted data via the 'content' parameter. However, the risk is negligible because the skill possesses no side-effect capabilities (e.g., network access, file writes, or system command execution) to act upon malicious instructions.
- CODE_QUALITY (INFO): The variable 'skill_dir' is referenced in the return statement but is not defined in the provided script, which will lead to a NameError during execution.
- DYNAMIC_EXECUTION (INFO): The script modifies 'sys.path' to import a local framework. This is a common pattern for local dependency management in agent skills and does not involve untrusted sources.
Audit Metadata