winback-engine

Pass

Audited by Gen Agent Trust Hub on May 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill is configured to use Bash, Read, and Write tools as defined in the YAML frontmatter to manage local processing and documentation during the campaign generation process.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface where untrusted data could influence agent behavior.
  • Ingestion points: Subscriber profile data, including names, tags, and engagement history, is retrieved from external Email Service Providers (ESPs) such as Klaviyo, Mailchimp, and others in SKILL.md.
  • Boundary markers: The skill lacks explicit boundary markers or instructions to the model to ignore potential commands embedded within the retrieved subscriber data during the drafting of personalized emails.
  • Capability inventory: The agent possesses several capabilities, including file system access (Read, Write), shell execution (Bash), and the ability to modify subscriber statuses (unsubscribe) through vendor-specific MCP tools.
  • Sanitization: No sanitization or validation routines for external subscriber data are specified before the data is used to generate campaign content.
Audit Metadata
Risk Level
SAFE
Analyzed
May 2, 2026, 06:43 AM
Security Audit — agent-trust-hub — winback-engine