gtm-competitive-strategy
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from an external file (
../../profiles/client-profile.md) to populate the competitive strategy and battlecard sections. This creates a surface where malicious or unintended instructions embedded within the profile data could influence the agent's behavior during the strategy generation process. - Ingestion points:
../../profiles/client-profile.md(read via context loading instructions inSKILL.md). - Boundary markers: The skill uses
{Client Profile: X}placeholders to denote where external data is inserted, but it lacks explicit safety instructions to the agent to ignore or sanitize embedded commands within that data. - Capability inventory: The skill possesses capabilities for markdown generation, HTML generation, and script-based PDF generation.
- Sanitization: No sanitization or validation logic is defined for the imported client profile content.
- [DYNAMIC_EXECUTION]: The skill documentation indicates support for generating output as a PDF using "Python + reportlab". This typically requires the agent to generate and execute a Python script at runtime to produce the document.
- Evidence: The
Artifact Generationsection inSKILL.mdspecifiesOption C: PDF — Python + reportlab.
Audit Metadata