product-marketing-context-global
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill functions as a template generator and data collection tool. It does not execute external scripts, install packages, or request elevated system privileges. All operations occur within the standard agent workspace through file creation at
.agents/product-marketing-context-global.md. - [CREDENTIALS_UNSAFE]: The skill includes explicit security instructions in Section 13 (Paid Ads), cautioning that agents and users must 'NEVER write tokens or passwords' when documenting ad accounts. This proactive measure mitigates the risk of accidental secret exposure in documentation files.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data by instructing the agent to pull 'Voice of Customer' quotes from platforms like Reddit, G2, and Trustpilot (Section 9). This represents a potential indirect prompt injection surface. However, the risk is assessed as safe because the skill treats this data as static markdown content for documentation rather than executable input for downstream automation.
- [REMOTE_CODE_EXECUTION]: There is no evidence of remote code execution patterns, such as piping network downloads to a shell or dynamic package installation.
- [OBFUSCATION]: The skill body and regional variants were analyzed for hidden characters, Base64 encoding, and homoglyphs; no such patterns were found.
Audit Metadata