landing-copy
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local and vendor-provided scripts to perform content validation. The script
scripts/verify.shis used for static linting of copy files, andnpx @ericrisco/rsc copy check <file>is used to enforce brand-voice and phrase restrictions. - [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and execute the@ericrisco/rscpackage from the npm registry. This package is scoped to the author's namespace and used for copy checking. - [INDIRECT_PROMPT_INJECTION]: The skill generates content based on user instructions and processes that content through linting tools. Ingestion points: User prompts defining landing page goals and features (SKILL.md). Boundary markers: None defined to isolate user instructions from agent logic. Capability inventory: Shell command execution (scripts/verify.sh, npx) and file system writes (SKILL.md). Sanitization: Textual linting for banned phrases is performed, but no input sanitization is mentioned prior to file generation or tool execution.
Audit Metadata