value-proposition-canvas
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided strings for the value proposition, customer segment, and optional context, which are directly interpolated into prompts for subagents.
- Ingestion points: Inputs for
[VALUE PROPOSITION],[CUSTOMER SEGMENT], and[CONTEXT]are handled inSKILL.mdand passed into the templates for six parallel subagents. - Boundary markers: User inputs are not wrapped in specific delimiters (such as XML tags or unique markdown blocks) and are not accompanied by explicit instructions to ignore potentially malicious instructions embedded in the input strings.
- Capability inventory: The skill performs file writes to the local working directory to save reports (as defined in
SKILL.md) and utilizes retrieval tools for evidence gathering as part of the analysis process. - Sanitization: No sanitization, validation, or escaping is performed on the user-provided context or segment descriptions before they are processed by the subagents.
- [COMMAND_EXECUTION]: The instructions in
SKILL.mddirect the agent to generate and save a markdown report file namedvalue-proposition-canvas-<subject-slug>-<YYYY-MM-DD>.mdin the current working directory. This is a core functional feature of the skill designed to provide the user with a permanent record of the analysis.
Audit Metadata