rfp-response-content-generation
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows professional document generation logic and does not contain any suspicious code, obfuscation, or persistent mechanisms.
- [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection as it processes external source documents provided in the RFP Tracker. This is a common pattern for data-processing skills and is mitigated by the following:
- Ingestion points: Strategy Brief, RFP Tracker, and various source documents (SKILL.md).
- Boundary markers: A mandatory 'Firm Position Boundary' check is enforced before drafting any section.
- Capability inventory: The skill is limited to reading local project files and writing a Word document to a workspace folder; it has no network access or shell execution capabilities.
- Sanitization: Instructions mandate strict grounding in source material, prohibit invention of proof points, and require the use of structured placeholders for missing data.
Audit Metadata