product-hunt-launch
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external documentation and installation instructions for the belt CLI tool hosted on a GitHub repository. It also suggests adding related skills using the npx skills add command to extend functionality.
- [COMMAND_EXECUTION]: Provides specific belt commands to run applications for image generation (using Flux Lora) and market research (using Tavily and Exa). These tools are used for generating marketing visuals and conducting competitor analysis, which aligns with the skill's stated purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill integrates search capabilities that ingest external data from web sources. While this creates a surface for untrusted data ingestion, the skill uses this information for research purposes and does not process it through high-privilege commands or sensitive file operations.
- Ingestion points: Search results from tavily/search-assistant and exa/search (SKILL.md)
- Boundary markers: None
- Capability inventory: belt app run for image generation and searching; no privileged file access or system modification tools
- Sanitization: None
Audit Metadata