marketing-pipeline
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from GitHub Pull Requests, git ref ranges, and local files. This data is sequentially passed as input through a chain of sub-skills. There is a risk that malicious instructions hidden within the input (e.g., in a PR description) could influence the agent's behavior during the marketing generation process.
- Ingestion points: SKILL.md Step 1 identifies input sources including GitHub PRs (URLs or numbers), git ref ranges, and local file/directory paths.
- Capability inventory: The agent can write multiple files to the local file system and invoke a series of downstream skills using the Skill tool as described in SKILL.md Step 2b and Step 4.
- Boundary markers: The instructions do not provide explicit delimiters or warnings to help the agent distinguish between data content and embedded instructions in the external inputs.
- Sanitization: There is no evidence of data sanitization or validation before processing external inputs.
- [DATA_EXFILTRATION]: The skill accesses and writes to the local file system to process input files and save generated marketing artifacts. While core to the skill's function, this interaction provides a surface for potential data exposure if the agent is manipulated into reading sensitive files or writing to unintended locations.
- Evidence: SKILL.md Step 1 and Step 2b detail reading from and writing to user-specified file system paths.
Audit Metadata