write-strategy
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/content_inventory.pyscript executes thehugobinary usingsubprocess.runto retrieve site metadata. This is a controlled execution of a specific, well-known tool required for analyzing Hugo-based projects. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data via web research to map competitive landscapes and benchmarks.
- Ingestion points: Web search results and fetched landing pages for competitors (defined in
references/competitor-analysis.mdandreferences/mckinsey-consultant.md). - Boundary markers: The skill enforces a strict 'Evidence contract' requiring inline tags like
[Evidence: URL]or[Assumption]and a mandatory 'Sources and Assumptions' section. - Capability inventory: The skill performs local file reads, executes the
hugocommand via subprocess, and writes analysis reports to the local filesystem. - Sanitization: The skill relies on structured fact extraction and agent-level interpretation rather than dynamic execution of fetched content, reducing the risk of accidental instruction obedience.
Audit Metadata