golden-business-card-sales-talk
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data including product manuals (PDF, JSON, Markdown) and web search results from Tavily, which could potentially contain malicious instructions aimed at the agent.
- Ingestion points: The skill reads user-uploaded files and external content retrieved via the Tavily tool (SKILL.md, references/research.md).
- Boundary markers: The instructions include a specific defensive directive stating that commands found within source content are not to be treated as authoritative or as permission-granting instructions (SKILL.md).
- Capability inventory: The skill has the ability to perform network searches and write files to the local environment (references/delivery.md, references/research.md).
- Sanitization: The skill advises using generalized keywords for research to avoid transmitting sensitive data to external services.
- [EXTERNAL_DOWNLOADS]: The skill integrates with the Tavily search/extract tool for competitor research (references/research.md). It follows security best practices by requiring the use of the platform's plugin architecture and the user's own connection, explicitly warning against asking for API keys in the chat (references/research.md).
Audit Metadata