craft-spec
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is composed strictly of a markdown instruction file containing a role-play prompt for a Product Manager. It contains no executable scripts, system commands, or external dependencies.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection as it processes raw user data (Slack threads, notes) provided via the
$ARGUMENTSvariable inSKILL.md. However, because the skill has no access to tools, network requests, or file system writes, the risk is negligible. The prompt uses<context>boundary markers to separate instructions from user-provided data. - [NO_CODE]: There are no Python, Node.js, or shell scripts associated with this skill, eliminating typical vectors for remote code execution or persistence.
Audit Metadata