offer-stack
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads and processes untrusted data from local project files, which creates an attack surface for indirect prompt injection.
- Ingestion points: The skill reads brand-config.json from the project root and gtm/offer-stack.json (or user-provided file paths) to extract ICP (Ideal Customer Profile) and offer draft data.
- Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore commands that may be embedded within the ingested JSON content.
- Capability inventory: Authorized capabilities include file reading, writing limited to the gtm/ directory, and executing a local Python scoring script via the Bash tool.
- Sanitization: The score_stack.py script validates JSON structure and numeric types but does not sanitize text content for potential natural language instructions before it is presented to the agent.
Audit Metadata