skills/octavehq/lfgtm/battlecard-doc/Gen Agent Trust Hub

battlecard-doc

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted data from external sources such as call transcripts, customer evidence, and uploaded competitor documents to populate competitive battlecards.
  • Ingestion points: The skill retrieves data from call transcripts and deal events using search_call_transcripts and get_event_detail as described in references/task-method.md. It also searches external resources like analyst reports via search_resources in references/tool-reference.md.
  • Boundary markers: The instructions do not explicitly mandate the use of delimiters or instructions for the agent to ignore potential injections within the retrieved text from these external sources.
  • Capability inventory: The skill generates HTML and text artifacts and performs extensive data retrieval operations across the workspace.
  • Sanitization: There is no explicit requirement for the agent to sanitize or escape the content fetched from transcripts or external documents before it is interpolated into the final output.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 07:24 PM