campaign-deck-builder
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [Indirect Prompt Injection Surface]: The skill processes user-supplied information to generate a PowerPoint deck. This process involves taking external input and placing it into a template, which is a common pattern for document automation.
- Ingestion points: User interview answers are captured via SKILL.md and stored in a local answers.json file.
- Boundary markers: Data is structured within a JSON object before being processed by the script, providing clear separation between data and instructions.
- Capability inventory: The scripts/build_campaign.py script utilizes the python-pptx library to write to the file system and generate the presentation.
- Sanitization: The script converts inputs to strings during the token replacement process; however, the potential for rendering untrusted content within a document is an inherent consideration for this type of workflow.
Audit Metadata