referral-program
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate marketing and growth engineering functionality. The instructions and documentation align with industry best practices for referral programs. The provided utility script,
scripts/referral_roi_calculator.py, is a standalone mathematical model that uses standard Python libraries for processing and reporting, with no network or sensitive file system interactions. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided marketing data and optional local context files, which represents an indirect prompt injection surface.
- Ingestion points: User-supplied product information, financial metrics (LTV, CAC), and the
marketing-context.mdfile. - Boundary markers: The skill does not currently implement specific delimiters or 'ignore embedded instructions' warnings for the data it processes.
- Capability inventory: The agent uses ingested data to inform growth strategy recommendations and to populate inputs for the local
scripts/referral_roi_calculator.pytool. - Sanitization: The agent instructions do not specify sanitization or validation of external content before it is interpolated into calculations or copy generation, although the ROI script itself utilizes safe JSON parsing.
Audit Metadata