winback-engine
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is configured to use
Bash,Read, andWritetools as defined in the YAML frontmatter to manage local processing and documentation during the campaign generation process. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface where untrusted data could influence agent behavior.
- Ingestion points: Subscriber profile data, including names, tags, and engagement history, is retrieved from external Email Service Providers (ESPs) such as Klaviyo, Mailchimp, and others in
SKILL.md. - Boundary markers: The skill lacks explicit boundary markers or instructions to the model to ignore potential commands embedded within the retrieved subscriber data during the drafting of personalized emails.
- Capability inventory: The agent possesses several capabilities, including file system access (
Read,Write), shell execution (Bash), and the ability to modify subscriber statuses (unsubscribe) through vendor-specific MCP tools. - Sanitization: No sanitization or validation routines for external subscriber data are specified before the data is used to generate campaign content.
Audit Metadata