oss-growth-attribution
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill performs extensive research by ingesting untrusted data from multiple external platforms, creating a potential surface for indirect injection.
- Ingestion points: The skill fetches data from the GitHub API and public social platforms including Reddit, Hacker News, Product Hunt, X, and YouTube as specified in
SKILL.mdandreferences/api-playbook.md. - Boundary markers: No explicit delimiters or system instructions to disregard instructions embedded in the external data are present in the provided files.
- Capability inventory: The skill's capabilities are restricted to information retrieval and reporting; it lacks tools for arbitrary file writing, shell execution, or making unauthenticated network requests.
- Sanitization: There is no mention of content sanitization or validation protocols for the external content before it is processed by the AI agent.
Audit Metadata