page-play-builder
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a strong authorization-first policy for all external side effects, including publishing, account mutations, and financial transactions, as defined in the Unified Skill Contract.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface by ingesting external data such as scraped text, reviews, and comments. However, it contains explicit defensive instructions in SKILL.md and references/skill-contract.md to treat such data as untrusted evidence and to disregard any embedded instructions.
- [COMMAND_EXECUTION]: While the skill references various marketing and SEO connectors (e.g., Google Search Console, HubSpot) in references/connectors.md, it does not contain any autonomous command execution or unauthorized API calls; these are listed as optional capabilities requiring external configuration.
Audit Metadata