reengagement-sequence

Pass

Audited by Gen Agent Trust Hub on Aug 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a bash preamble that detects the RMBC environment by searching for the dtc-copywriting-skills directory and checks for updates using a local binary.
  • [COMMAND_EXECUTION]: It parses and modifies local configuration at ~/.rmbc-skills/config.yaml using grep and sed to manage user preferences and active workspaces.
  • [EXTERNAL_DOWNLOADS]: The skill triggers the opening of a YouTube video (https://www.youtube.com/watch?v=zI8tNfefH1M) for onboarding. YouTube is a well-known service.
  • [DATA_EXFILTRATION]: It utilizes a local rmbc-analytics tool to log skill usage and success metrics. The telemetry is scoped to the skill's framework and includes a user-controlled opt-out mechanism.
  • [PROMPT_INJECTION]: The skill ingests untrusted data through brand_name, target_audience, key_value_prop, and win_back_offer inputs in SKILL.md. No boundary markers or sanitization are present. The skill possesses capabilities for file system modification (mkdir, touch, sed), execution of local binaries (rmbc-analytics), and opening browser URLs.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 11, 2026, 01:37 PM
Security Audit — agent-trust-hub — reengagement-sequence