craft-discovery-synthesis
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill is entirely comprised of markdown instructions and does not include any executable code, scripts, or binary files. It functions solely as a prompt template for the AI agent.
- [PROMPT_INJECTION]: The instructions use standard persona-setting techniques for product management and UX research. No patterns indicating an attempt to bypass safety guidelines, extract system prompts, or override core agent behavior were identified.
- [DATA_EXFILTRATION]: There are no network calls, hardcoded credentials, or instructions to send data to external services. The processing occurs entirely within the agent's context.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data via the $ARGUMENTS placeholder. Although this creates a surface for indirect instructions hidden in research notes, the risk is negligible because the skill does not use any tools (filesystem, network, or shell) that could be exploited. The inclusion of tags serves as a basic boundary for the untrusted input.
Audit Metadata