launch-window-planner
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill ingests data from external sources and user pastes, creating a surface for indirect prompt injection.
- Ingestion points: Data enters the agent context via scripts/connectors/producthunt.py, hn.py, and gdelt.py, as well as user-provided calendars.
- Boundary markers: The instructions in SKILL.md explicitly warn to treat these inputs as untrusted and cite SECURITY.md protocols.
- Capability inventory: The skill has permissions to write to local memory/ subdirectories and execute local Python scripts.
- Sanitization: Instructional guardrails are present to ignore instructions found in fetched data.
- [COMMAND_EXECUTION]: The skill executes local Python scripts (producthunt.py, hn.py, gdelt.py, and registry-events.py) to gather timing data and propose registry updates.
- [EXTERNAL_DOWNLOADS]: The skill retrieves telemetry and community rhythm data from well-known external services, including Product Hunt and Hacker News.
Audit Metadata