landing-copy

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes local and vendor-provided scripts to perform content validation. The script scripts/verify.sh is used for static linting of copy files, and npx @ericrisco/rsc copy check <file> is used to enforce brand-voice and phrase restrictions.
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and execute the @ericrisco/rsc package from the npm registry. This package is scoped to the author's namespace and used for copy checking.
  • [INDIRECT_PROMPT_INJECTION]: The skill generates content based on user instructions and processes that content through linting tools. Ingestion points: User prompts defining landing page goals and features (SKILL.md). Boundary markers: None defined to isolate user instructions from agent logic. Capability inventory: Shell command execution (scripts/verify.sh, npx) and file system writes (SKILL.md). Sanitization: Textual linting for banned phrases is performed, but no input sanitization is mentioned prior to file generation or tool execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 11:19 PM