region-config
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied regional configuration data (such as region names, languages, and platform preferences) which is then stored and automatically propagated to downstream marketing commands like content-calendar and email-sequence.
- Ingestion points: User input fields for regional parameters and existing brand profile files located at
~/.claude-marketing/brands/{slug}/profile.json(SKILL.md). - Boundary markers: The skill instructions do not specify the use of delimiters or clear "ignore embedded instructions" warnings when interpolating these regional settings into the agent context.
- Capability inventory: The skill has permissions to read and write persistent JSON configuration files in the
~/.claude-marketing/directory (SKILL.md). - Sanitization: No explicit sanitization, validation, or escaping of the user-provided regional data is mentioned before it is processed and saved.
Audit Metadata