cms-event-publish
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, such as prompt injection, obfuscation, or unauthorized data access, were identified in the skill instructions.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as an interface for user-provided content (event titles, descriptions, and blocks). It mitigates potential injection risks by enforcing a strict workflow that includes a mandatory confirmation step.
- Ingestion points: User-provided inputs for event titles and body paragraphs (text, quote, photo, embed).
- Boundary markers: A mandatory 'Preview (dry-run)' step requires explicit user confirmation before any tool-based mutation occurs.
- Capability inventory: The skill uses a set of domain-specific tools (
cms_create_event,cms_create_event_paragraph, etc.) to modify CMS content. - Sanitization: The skill enforces strict validation for ISO datetime formats and timezone offsets to prevent logical errors in scheduling.
- [COMMAND_EXECUTION]: The tool calls are restricted to the platform's specific CMS API. There are no attempts to execute arbitrary shell commands or system-level operations.
Audit Metadata