skills/pluginagentmarketplace/custom-plugin-engineering-manager/culture-engagement/Gen Agent Trust Hub
culture-engagement
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines multiple YAML structures in
SKILL.md(e.g.,psychological_safety_pulse,team_culture_canvas) designed to ingest user-provided data such as team names, value definitions, and ritual descriptions.\n - Ingestion points: User input interpolated into fields like
{Team name},{definition}, and{Observable behavior}across multiple templates inSKILL.md.\n - Boundary markers: Absent; there are no delimiters or explicit instructions to the agent to treat user-supplied content as untrusted data rather than potential instructions.\n
- Capability inventory: The skill relies on a static analysis script (
scripts/engagement_survey.py) and informational frameworks; it does not request or demonstrate capabilities for network access, system file modification, or dynamic code execution.\n - Sanitization: No logic for escaping, filtering, or validating the free-text content in these templates is provided within the skill instructions.
Audit Metadata