reengagement-sequence
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a bash preamble that detects the RMBC environment by searching for the
dtc-copywriting-skillsdirectory and checks for updates using a local binary. - [COMMAND_EXECUTION]: It parses and modifies local configuration at
~/.rmbc-skills/config.yamlusinggrepandsedto manage user preferences and active workspaces. - [EXTERNAL_DOWNLOADS]: The skill triggers the opening of a YouTube video (
https://www.youtube.com/watch?v=zI8tNfefH1M) for onboarding. YouTube is a well-known service. - [DATA_EXFILTRATION]: It utilizes a local
rmbc-analyticstool to log skill usage and success metrics. The telemetry is scoped to the skill's framework and includes a user-controlled opt-out mechanism. - [PROMPT_INJECTION]: The skill ingests untrusted data through
brand_name,target_audience,key_value_prop, andwin_back_offerinputs inSKILL.md. No boundary markers or sanitization are present. The skill possesses capabilities for file system modification (mkdir,touch,sed), execution of local binaries (rmbc-analytics), and opening browser URLs.
Audit Metadata