early-access-designer
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources like scraped web pages, reviews, and emails. While it contains explicit instructions to treat these as untrusted evidence and not follow embedded instructions, the surface area for indirect injection exists.
- Ingestion points:
SKILL.md(reads public or connected data sources, scraped text, reviews, comments, and emails). - Boundary markers: Present in
references/skill-contract.mdandSKILL.md, which specify that external content must be treated as evidence rather than instructions. - Capability inventory: The skill generates recommendations and can potentially trigger external tool integrations (e.g., Google Ads, HubSpot, Stripe) via the connector layer defined in
references/connectors.md. - Sanitization: Employs specific instructions to treat all evidence as untrusted input.
- [DATA_EXFILTRATION]: The skill defines a protocol for external side effects in
SKILL.mdandreferences/skill-contract.md, ensuring that actions like publishing, sending data, or mutating accounts require explicit user authorization. - [CREDENTIALS_UNSAFE]: The
references/connectors.mdfile correctly enforces secret management best practices by instructing that API keys must be kept out of skill files and source control.
Audit Metadata