lifecycle-email
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs legitimate email drafting and scoring tasks by reading and writing to specific local directories (
./gtm/). - [COMMAND_EXECUTION]: The skill uses a
python3command to execute a local scoring script (score.py). This script is part of the skill's own package and is used to validate the generatedsequence.jsonfile. The command execution is constrained to this internal script. - [DATA_EXPOSURE_&_EXFILTRATION]: The skill reads from a local
brand-config.jsonfile to inform its drafting process. It does not perform any network operations and explicitly states 'No network' in its execution instructions. - [INDIRECT_PROMPT_INJECTION]: While the skill processes user-supplied 'pain' descriptions, the risk is minimal as the data is used to populate a JSON structure which is then scored by a local script. There are no high-privilege capabilities triggered by this data.
Audit Metadata