meta-premium-go-to-market
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data, such as business briefs and research notes, which presents a surface for indirect prompt injection if those files contain malicious instructions.\n
- Ingestion points: According to
SKILL.md, the skill reads "Premium Go To Market brief", "approved project files", "research notes", and "operating records" from the client or plan owner.\n - Boundary markers: The skill does not define specific delimiters or provide instructions to the agent to ignore potentially malicious embedded content within the ingested data.\n
- Capability inventory: The risk is mitigated by explicit "Capability and Permission Boundaries" in
SKILL.mdthat restrict the agent to read-only operations and non-mutating checks, with no access to network exfiltration or destructive file operations.\n - Sanitization: There are no specified procedures for sanitizing or validating the content of the ingested project files before processing.\n- [EXTERNAL_DOWNLOADS]: The skill references an external market report from a well-known consulting firm.\n
- Evidence:
references/premium-gtm-quality-gate.mdincludes a link to an official McKinsey & Company luxury market report (https://www.mckinsey.com/industries/retail/our-insights/state-of-luxury-2025) used to support value model definitions.
Audit Metadata