subject-line-lab
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data, creating a surface for indirect prompt injection.\n
- Ingestion points: The skill ingests subject line candidates, competitor data, and native ESP campaign CSV exports from the user's environment (referenced in
SKILL.mdandData Sources).\n - Boundary markers: The instructions do not specify the use of strict boundary markers (e.g., XML tags or unique delimiters) when interpolating this untrusted data into the prompt context.\n
- Capability inventory: The agent is directed to write analysis results to the local filesystem (
memory/email/subject-line-lab/) and references a local script (registry-events.py) to update data registries.\n - Sanitization: The skill lacks explicit sanitization or filtering logic for the input data, relying instead on a general textual instruction for the agent to disregard embedded commands.\n- [COMMAND_EXECUTION]: The skill instructions reference the execution of a local Python script for data operations.\n
- Evidence: The
Instructionssection inSKILL.mddirects the agent to append claims usingregistry-events.py.\n - Context: The execution is specifically gated by a requirement for "separate explicit authorization" for each operation, providing a layer of human-in-the-loop control.
Audit Metadata