saas-product-demo-production
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill includes extensive 'Non-negotiable' constraints that prioritize data privacy, explicitly forbidding the capture of PII, secrets, API keys, and session tokens. It references NIST SP 800-122 and 800-188 for data protection standards.
- [SAFE]: The instructions mandate a 'claims ledger' and substantiation process to ensure all product claims are truthful and non-deceptive, aligning with FTC advertising guidelines.
- [SAFE]: The workflow incorporates mandatory accessibility checks, requiring timed captions and high contrast ratios as defined by WCAG 2.2 standards.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input in the form of 'product briefs' to generate demo plans. While this represents a potential injection surface, the skill mitigates this through strict production constraints, mandatory stakeholder reviews, and a detailed QA checklist that validates the agent's output against the product truth and safety requirements. Severity: LOW.
Audit Metadata