marketing-psychology
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill includes a directive to read a project-specific context file (
.claude/product-marketing-context.md) to tailor its marketing advice. This creates a potential surface for indirect prompt injection if the content of that file is sourced from an untrusted origin. - Ingestion points: The file
.claude/product-marketing-context.mdis explicitly checked and read by the agent (referenced inSKILL.md). - Boundary markers: No specific boundary markers or instructions to ignore potentially malicious embedded commands are provided for when the agent reads this file.
- Capability inventory: The skill does not request or implement any tools for network communication, file system writes, or shell command execution, limiting the impact of any potential injection.
- Sanitization: The skill lacks explicit sanitization or validation logic for the data ingested from the external context file.
Audit Metadata