plan-campaign

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites and marketing research files which are then used to generate campaign reports and automated prompts.
  • Ingestion points: The references/intake.md file mandates fetching the brand's live site and reading research files like the customer-words bank and competitor reports.
  • Boundary markers: There are no specific instructions to use delimiters or safety wrappers when processing this external content.
  • Capability inventory: The skill possesses significant capabilities, including writing to campaign records (gooseworks:campaign_upsert), saving files to the brain (save-to-brain), and creating scheduled automations (gooseworks:automation_upsert).
  • Sanitization: The instructions do not define sanitization or filtering logic for the ingested external data.
  • [DYNAMIC_EXECUTION]: The skill dynamically assembles an agent_prompt for scheduled tasks in references/run-memory.md.
  • Evidence: The skill uses a template to build a complex prompt string that includes workspace paths and relative file references, which is then passed to the gooseworks:automation_upsert tool to define the behavior of future agent runs.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 01:55 PM