customer-research
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a legitimate toolkit for customer research and persona generation. It identifies and utilizes local context files (e.g.,
product-marketing.md) to improve the quality of its output, which is a standard and safe design pattern for maintaining project context. - [PROMPT_INJECTION]: The skill's primary function involves processing untrusted external data, such as customer interview transcripts, survey results, and content harvested from online forums and review sites. This creates an indirect prompt injection surface. However, this ingestion is a necessary part of the skill's primary research purpose, and the agent's actions are restricted to data analysis and synthesis without the use of dangerous tools or command execution.
- Ingestion points: Raw research material, including transcripts and online community posts from Reddit, G2, and other sources mentioned in
SKILL.mdandreferences/source-guides.md, are processed by the agent. - Boundary markers: The skill instructs the agent to use specific synthesis templates and extraction frameworks (e.g., Jobs to Be Done, Pain Points) to organize the data, although it does not implement technical delimiters.
- Capability inventory: The instructions are limited to textual analysis and report generation. There are no patterns suggesting the use of subprocesses, network exfiltration, or file modifications based on the processed content.
- Sanitization: The skill does not explicitly define sanitization steps, which is typical for skills focused on qualitative data analysis.
Audit Metadata