competitive-landing-page
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill researches and processes data from external review platforms like G2, Capterra, and TrustRadius to populate landing page content. 1. Ingestion points: External review websites and user-provided asset URLs (SKILL.md). 2. Boundary markers: The skill instructions include quality gates for marketing accuracy but lack explicit security boundaries or instructions to treat external data as untrusted. 3. Capability inventory: The agent has the capability to write production-ready HTML files to the local file system (SKILL.md). 4. Sanitization: There is no instruction to sanitize or escape data before it is interpolated into the generated HTML and JavaScript code, which could allow malicious scripts embedded in reviews to be executed in the final output.
- [DYNAMIC_EXECUTION]: Generates a complete, self-contained HTML landing page with embedded CSS and JavaScript logic. Evidence: The instructions guide the agent to produce production-ready HTML with inline styles and interactive JavaScript components such as FAQ accordions (SKILL.md, examples/pipelineos-vs-dealforce.html).
- [EXTERNAL_DOWNLOADS]: The skill and its generated output reference and fetch resources from external domains. Evidence: Fetches logo SVGs from user-provided URLs and references typography from Google Fonts (SKILL.md, examples/pipelineos-vs-dealforce.html).
Audit Metadata