saas-lifecycle-email-and-retention
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external inputs such as client briefs, project files, and CRM/event-tracking records to generate marketing recommendations. While this represents an attack surface for indirect prompt injection, the skill includes robust safety controls. It mandates halting conclusions if required evidence (consent basis, churn signals) is missing and specifies that the agent should remain read-only unless explicit authority is granted by the plan owner. These boundaries and explicit stop conditions effectively mitigate the risk.
- [SAFE]: The skill does not contain executable scripts, network commands, or persistence mechanisms. It references well-known service providers (such as Twilio, HubSpot, and Postmark) and industry-standard protocols (SPF, DKIM, DMARC) in a purely instructional context. Metadata and reference paths are legitimate and consistent with the stated purpose of strategic marketing consulting.
Audit Metadata