create-launch-post

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Pull Requests and documentation to generate blog posts and social media threads.
  • Ingestion points: The agent researches release facts by inspecting source PRs, implementation details, and existing documentation (SKILL.md).
  • Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the ingested PR content.
  • Capability inventory: The agent can create GitHub Pull Requests, upload assets to Cloudflare R2 via AWS CLI, and schedule social media threads using the Buffer MCP.
  • Sanitization: No specific sanitization or filtering logic is defined for data extracted from the repository's PRs or documentation.
  • [DYNAMIC_EXECUTION]: The skill utilizes Playwright to render HTML templates into launch images.
  • The scripts render-launch-images.ts and render-tile-images.ts dynamically construct HTML strings containing feature titles and code snippets, which are then rendered in a headless browser to generate the blog hero and social media PNGs.
  • [COMMAND_EXECUTION]: The skill automates repository management and infrastructure tasks using standard CLI tools.
  • Operations include jj (Jujutsu) for version control isolation, aws for asset storage uploads, op (1Password) for secure credential retrieval, and pnpm for executing the bundled TypeScript rendering utilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 05:53 AM