ab-test-plan
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
python campaign-tracker.pyandscripts/sample-size-calculator.py. These commands use arguments, such as{slug}, which are sourced from local JSON files in the~/.claude-marketing/directory. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection vulnerability surface. Ingestion points: Data is read from
~/.claude-marketing/brands/(profiles and guidelines) and campaign history logs. Boundary markers: No delimiters or instructions to ignore embedded commands are present in the processing logic. Capability inventory: The skill has the ability to execute shell commands and write detailed experiment specifications. Sanitization: There is no evidence of validation or escaping for data used in command execution or prompt construction.
Audit Metadata