Agentic Builder Lab

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied build metadata such as build names, stack descriptions, and key learnings, and interpolates them directly into multiple artifact templates including MDX logs, LinkedIn posts, and video demo scripts.
    • Ingestion points: User-provided inputs defined in the inputs block of SKILL.md.
    • Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the processed inputs.
    • Capability inventory: The skill performs file system writes across multiple directories (content/, drafts/, skills/), executes a bash grep command for linting, and suggests using npx for rendering diagrams.
    • Sanitization: No explicit sanitization or validation logic is applied to the input values before they are interpolated into the final artifacts.
  • [REMOTE_CODE_EXECUTION]: The skill documentation in resources/diagram-prompt.md provides an execution pattern using npx to download and run the @mermaid-js/mermaid-cli package.
  • [EXTERNAL_DOWNLOADS]: The skill fetches the Mermaid CLI tool from the official npm registry during the diagram rendering phase.
  • [COMMAND_EXECUTION]: The skill executes a bash grep command to perform automated linting of the generated files to ensure compliance with the voice specification defined in resources/voice-spec.md.
  • [DYNAMIC_EXECUTION]: The skill utilizes npx for runtime package execution to convert Mermaid source files into SVG diagrams.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 09:15 AM