paywall-upgrade-cro
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external and untrusted sources, including web content and third-party integrations (CRM, Ads, SEO tools), which creates a potential surface for indirect prompt injection attacks.
- Ingestion points: SKILL.md and references/connectors.md specify reading from user context, project files, and various external tools like Google Search Console, HubSpot, and Stripe.
- Boundary markers: The instructions in SKILL.md and references/skill-contract.md explicitly direct the agent to treat scraped text, reviews, and comments as 'untrusted input' and not to follow instructions embedded within them.
- Capability inventory: The skill generates recommendations and plans, and can interact with integration layers like Zapier or Composio as described in references/connectors.md.
- Sanitization: The skill relies on explicit instructional guardrails to ignore embedded commands within ingested data rather than programmatic sanitization.
- [SAFE]: The skill follows security best practices by explicitly instructing the agent to keep API keys out of source control and requiring user authorization for any persistent writes or external side effects.
Audit Metadata