marketing-os
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [NO_CODE]: The skill package contains only Markdown and YAML files. No executable scripts, binaries, or command-line tools are included, which significantly limits the attack surface.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data, such as product documentation and user-provided research, which is a common surface for indirect prompt injection. However, it incorporates strong defensive guidelines to mitigate this risk:
- Ingestion points: Processes project-specific context files (e.g.,
.agents/marketing-context.md) and user-supplied business goals. - Boundary markers: Implements a strict data labeling system in
references/evidence-and-context.md, distinguishing between 'Verified', 'User-provided', 'Analysis', and 'Hypothesis' states. - Capability inventory: The skill primarily functions as a router for other specialist skills; it does not contain direct file-write, network exfiltration, or code execution capabilities.
- Sanitization: Includes an 'Adversarial check' section and a 'Protect the truth boundary' instruction set that forces the agent to validate facts and record counterevidence, preventing the automatic adoption of potentially malicious instructions embedded in research data.
- [DATA_EXFILTRATION]: No network-enabled tools or commands (such as curl or wget) are present. The skill instructions explicitly forbid connecting accounts or altering live campaigns without authorization.
Audit Metadata