offer-card
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill operates as a static template for offer generation. No indicators of credential theft, remote code execution, or unauthorized file access were found across the instructions or reference documents.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted data, which is analyzed as follows:
- Ingestion points: The skill ingests user-provided metrics, buyer testimonials, and offer details as described in
SKILL.md. - Boundary markers: The instructions implement a labeling system (
(yours)vs(estimate)) to differentiate user-supplied data from agent-generated content, though it lacks explicit delimiters for raw input strings. - Capability inventory: None. The skill is strictly limited to text formatting and does not utilize any tools for network access, file system modification, or command execution.
- Sanitization: No explicit sanitization or escaping of user-provided strings is performed, but the lack of executable capabilities makes this surface functionally safe.
Audit Metadata