make-content
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content which creates a surface for indirect prompt injection attacks.
- Ingestion points: The skill ingests data from external web pages via
gooseworks:data_call_provider, media transcripts throughgooseworks:media_analyze, and competitor data. - Boundary markers: It utilizes a tagging system (
[PROOF NEEDED],[CUSTOMER APPROVAL NEEDED]) to identify and isolate unverified claims or external data within drafts. - Capability inventory: The agent can write to the workspace via
gooseworks:file_writeand update the brand's knowledge base usinggooseworks:knowledge_import. - Sanitization: The skill implements a strict human-in-the-loop policy ("Nothing is published — you edit and post") and a multi-pass substance and readability review to filter out malicious or unintended instructions.
- [EXTERNAL_DOWNLOADS]: The skill performs research by fetching content from public websites and social media platforms (LinkedIn, Threads, X) using authorized vendor tools. These operations are intended for gathering market insights and competitor information.
Audit Metadata