marketing-launch
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the 'agent-browser' extension from Vercel Labs' official GitHub repository. This dependency is installed via 'npx skills add', which is a standard procedure for this environment.
- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it ingests unstructured data from external websites (Product Hunt, Reddit, LinkedIn) via the browser tool.
- Ingestion points: Research Mode commands in SKILL.md that fetch text from remote URLs.
- Boundary markers: None identified in the scraping logic.
- Capability inventory: The skill has the ability to write files to the local brand workspace and execute browser commands.
- Sanitization: No explicit sanitization of the scraped content is performed before it is processed by the agent.
- [COMMAND_EXECUTION]: Provides example shell commands for the agent-browser tool to facilitate research tasks. These commands target reputable domains and do not involve suspicious execution patterns.
Audit Metadata