launch-retro-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists entirely of instructional Markdown files without any executable scripts, binary files, or automated configuration changes. It defines a workflow for analysis rather than executing technical commands.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process potentially untrusted external data, such as scraped web text, reviews, and emails. However, it includes robust defensive instructions in the 'Data Sources' and 'Unified Skill Contract' sections, requiring the agent to treat these sources as evidence only and explicitly ignore any embedded instructions. This effectively mitigates the risk of indirect injection.
- [COMMAND_EXECUTION]: While the skill mentions various marketing and SEO tools (e.g., Google Search Console, HubSpot, Zapier) in its documentation, it does not include any code or logic to interact with these services directly. It advises keeping API keys out of source control and defaulting to read-only behavior.
- [DATA_EXFILTRATION]: The skill instructions explicitly prohibit performing persistent writes or external side effects, such as sending data or mutating accounts, without explicit user authorization, which prevents unauthorized data movement.
Audit Metadata