create-linkedin-content
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied briefs and voice guides which are potential vectors for indirect instructions.\n
- Ingestion points: Input is received via the
--briefflag and by reading voice guide files from the~/.goose-skills/directory (SKILL.md).\n - Boundary markers: There are no explicit markers or instructions to isolate the data from the agent's core logic.\n
- Capability inventory: The skill is capable of writing markdown files to the local file system during its output phase (SKILL.md).\n
- Sanitization: The skill does not perform sanitization on the brief or voice guide content before processing.\n- [EXTERNAL_DOWNLOADS]: The skill installation utilizes a command to fetch resources from a remote registry (
npx goose-skills). This is a standard installation pattern for the vendor.
Audit Metadata