battlecard-builder
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data regarding competitors and market intel to generate battlecards, which presents an attack surface for indirect prompt injection.
- Ingestion points: Competitor research and product data provided by the user or fetched by related skills (competitive-intel) to populate the battlecard templates in
SKILL.mdandtemplates/output-template.md. - Boundary markers: The skill employs structured Markdown output formats and requires the use of the Fact-Impact-Act (FIA) framework, which provides clear delimiters between different sections of the generated content.
- Capability inventory: The skill includes a Python script
scripts/check-output.pyused to read generated files and validate the presence of required headers. The skill instructions also suggest integration with related skills for data gathering. - Sanitization: There are no explicit instructions or automated steps defined within the skill to sanitize or filter potential instructions embedded within the ingested competitor data.
Audit Metadata