corporate-surface
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external inputs such as project briefs, copy, and links. This creates a surface where malicious instructions could be embedded in the data provided to the agent. However, the skill does not define any automated actions or tool usage that would allow such instructions to cause harm.
- Ingestion points: SKILL_CARD.md identifies inputs such as "brief, screenshots, approved copy, real product assets, links".
- Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the input data.
- Capability inventory: The skill does not include any scripts or use any tools (allowed-tools is not defined, and no shell/python execution is present).
- Sanitization: No sanitization or validation logic is defined for the input data.
- [NO_CODE]: The skill consists entirely of Markdown and YAML files. There are no scripts (Python, JavaScript, Shell) or binaries associated with this skill, which significantly reduces its attack surface.
Audit Metadata