strategy-and-roadmap
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external project files which could theoretically contain malicious instructions.
- Ingestion points: Reads data from
docs/gtm-cofounder/founder-brief.mdto generate the strategy. - Boundary markers: No explicit delimiters are used to separate the ingested brief content from the agent's internal reasoning instructions.
- Capability inventory: The skill is limited to reading and writing local markdown files (
docs/gtm-cofounder/gtm-roadmap.md). It does not utilize subprocess execution, network operations, or dynamic code evaluation. - Sanitization: No input validation or escaping is applied to the content read from the founder brief.
- [SAFE]: All file operations are restricted to the
docs/gtm-cofounder/directory within the user's project, which is consistent with the skill's stated purpose of documentation and planning.
Audit Metadata