campaign-launch-qa

Pass

Audited by Gen Agent Trust Hub on Jun 14, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill processes untrusted data which creates a surface for indirect prompt injection. It aggregates campaign details from upstream skills and incorporates user-provided notes into final readiness reports.
  • Ingestion points: Data enters from upstream skills including scope-audit, fte-capacity-sizing, and margin-simulation, as well as user-provided checklist 'notes' (SKILL.md).
  • Boundary markers: There are no explicit delimiters or instructions to the agent to disregard embedded instructions within the processed data.
  • Capability inventory: The skill executes a local Python script (scripts/qa_scorer.py) and has the capability to trigger downstream skills like executive-growth-memo.
  • Sanitization: No sanitization or validation of the external content is performed before interpolation into the final visual and markdown outputs.
  • [COMMAND_EXECUTION]: The skill involves the execution of a local Python script to perform its core functionality of campaign scoring.
  • Evidence: The SKILL.md file provides instructions and examples for executing scripts/qa_scorer.py using the system Python interpreter.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 14, 2026, 01:01 AM