marketing-skills
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill suite is designed to ingest and process external, untrusted content such as articles, drafts, and social media posts for brand voice and SEO analysis.
- Ingestion points: Multiple scripts, including
brand_voice_analyzer.py,seo_optimizer.py, andcontent_scorer.py, are documented to take user-supplied text files as inputs. - Boundary markers: The documentation does not specify the use of boundary markers or instructions for the agent to ignore embedded commands within the analyzed content.
- Capability inventory: The skills are granted capabilities to execute shell commands (
python3) and read files from the filesystem. - Sanitization: There is no mention of input sanitization or validation of the text content before it is processed by the agent or scripts.
- [EXTERNAL_DOWNLOADS]: The documentation instructions recommend installing the skills using
npx ai-agent-skills install, which downloads and executes components from a remote repository (alirezarezvani/claude-skills) during the installation process. - [COMMAND_EXECUTION]: The marketing operations workflow involves the frequent execution of over 30 external Python scripts via the command line to perform various analysis and tracking tasks.
Audit Metadata