product-marketing-context
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill operates entirely within the local project environment, reading existing documentation and writing a new context file (
.agents/product-marketing-context.md). No network activity or external downloads are present. - [INDIRECT_PROMPT_INJECTION]: The skill includes an 'auto-draft' feature that reads codebase files such as READMEs, landing pages, and
package.jsonto extract marketing information. - Ingestion points: Local repository files (README, landing pages, marketing copy,
package.json). - Boundary markers: None explicitly defined in the instructions for separating file content from the prompt.
- Capability inventory: File system read/write access.
- Sanitization: None explicitly mentioned for the extracted content.
- Assessment: While this ingestion creates a surface for indirect prompt injection, the risk is inherent to the skill's primary purpose of summarizing codebase information, and the resulting output is a static marketing document rather than executable code.
Audit Metadata