create-launch-post
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Pull Requests and documentation to generate blog posts and social media threads.
- Ingestion points: The agent researches release facts by inspecting source PRs, implementation details, and existing documentation (SKILL.md).
- Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the ingested PR content.
- Capability inventory: The agent can create GitHub Pull Requests, upload assets to Cloudflare R2 via AWS CLI, and schedule social media threads using the Buffer MCP.
- Sanitization: No specific sanitization or filtering logic is defined for data extracted from the repository's PRs or documentation.
- [DYNAMIC_EXECUTION]: The skill utilizes Playwright to render HTML templates into launch images.
- The scripts
render-launch-images.tsandrender-tile-images.tsdynamically construct HTML strings containing feature titles and code snippets, which are then rendered in a headless browser to generate the blog hero and social media PNGs. - [COMMAND_EXECUTION]: The skill automates repository management and infrastructure tasks using standard CLI tools.
- Operations include
jj(Jujutsu) for version control isolation,awsfor asset storage uploads,op(1Password) for secure credential retrieval, andpnpmfor executing the bundled TypeScript rendering utilities.
Audit Metadata