product-marketing-context
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill reads repository files such as README, landing pages, and package.json to extract marketing information. This data access is restricted to the current project context for the purpose of drafting a context document.- [COMMAND_EXECUTION]: The skill writes information to the local file system at
.agents/product-marketing-context.md. It also performs checks for older configurations in the.claude/directory.- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection because it processes content from the repository (README, marketing copy) which could contain adversarial instructions. - Ingestion points: Codebase files including README, landing pages, and package.json are scanned during the auto-drafting phase (SKILL.md).
- Boundary markers: The instructions do not specify explicit delimiters or warnings to ignore instructions within the read content.
- Capability inventory: The agent has file read and write capabilities used to analyze the codebase and store the resulting document.
- Sanitization: No automated sanitization of ingested content is mentioned.
- Mitigation: The skill includes a mandatory human-in-the-loop review step where the user must approve and correct the draft before it is saved.
Audit Metadata