launch-strategy
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local Python script
scripts/launch_readiness_scorer.pyto calculate readiness scores based on a JSON checklist. This is a controlled execution of a script bundled with the skill. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process data from external files, which introduces a potential surface for indirect prompt injection.
- Ingestion points: The agent is instructed in
SKILL.mdto read.claude/product-marketing-context.mdif available. Additionally, the readiness scorer script reads external JSON files via the--checklistargument. - Boundary markers: The instructions do not define specific delimiters or security warnings to treat the content of these external files as untrusted data.
- Capability inventory: The skill has the capability to read local files and execute a bundled Python script.
- Sanitization: There is no evidence of explicit sanitization or filtering of the content ingested from the marketing context or JSON checklist before it is incorporated into the agent's reasoning process.
Audit Metadata