campaign-launch-qa
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data which creates a surface for indirect prompt injection. It aggregates campaign details from upstream skills and incorporates user-provided notes into final readiness reports.
- Ingestion points: Data enters from upstream skills including
scope-audit,fte-capacity-sizing, andmargin-simulation, as well as user-provided checklist 'notes' (SKILL.md). - Boundary markers: There are no explicit delimiters or instructions to the agent to disregard embedded instructions within the processed data.
- Capability inventory: The skill executes a local Python script (
scripts/qa_scorer.py) and has the capability to trigger downstream skills likeexecutive-growth-memo. - Sanitization: No sanitization or validation of the external content is performed before interpolation into the final visual and markdown outputs.
- [COMMAND_EXECUTION]: The skill involves the execution of a local Python script to perform its core functionality of campaign scoring.
- Evidence: The
SKILL.mdfile provides instructions and examples for executingscripts/qa_scorer.pyusing the system Python interpreter.
Audit Metadata