launch
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository environment to generate marketing copy, which exposes the agent to adversarial instructions.
- Ingestion points: The skill reads from .agents/product-marketing.md and repository metadata, specifically pull request titles/descriptions and commit messages in references/shipped-changes.md.
- Boundary markers: No clear delimiters or instructions are provided to the agent to treat external content as data rather than instructions.
- Capability inventory: The skill uses file reading and shell command execution to retrieve project information.
- Sanitization: The instructions do not specify any sanitization or validation of the text retrieved from the repository.
- [COMMAND_EXECUTION]: The skill uses local shell commands to interact with the version control system.
- Evidence: The references/shipped-changes.md file explicitly instructs the agent to run
git log --since=\"1 week ago\" --no-merges --pretty=format:\"%h %s (%an, %ar)\"to extract commit history.
Audit Metadata