run-paid-campaigns-apply-and-log
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and processing untrusted data to drive sensitive campaign management actions.
- Ingestion points: The skill reads user input via the
user_instructionparameter (Step 5) and processes content from local files includingads/campaigns/<slug>/state.md(Step 1, 6, 7) anddecisions.md(Step 7, 11). - Boundary markers: No explicit delimiters (e.g., XML tags or special markers) are defined to isolate user-provided instructions or file content from the agent's core instructions.
- Capability inventory: The skill uses vendor-specific tools for sensitive operations:
gooseworks:propose_meta_budget_change,gooseworks:propose_meta_creative_replacement,gooseworks:prepare_meta_ad_push, andgooseworks:pause_meta_ad_push. It also has broad file system write access to update campaign state and decision logs. - Sanitization: There is no evidence of sanitization, validation, or filtering for the external content before it is interpolated into prompts or used to trigger tool execution.
Audit Metadata