campaign-review
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions specify the execution of a local script at
scripts/run-state-check.jsusing Node.js to perform the campaign review. This command is a core component of the skill's intended functionality and operates on local files. - [PROMPT_INJECTION]: The skill processes external campaign data and results provided by the user, which serves as a potential surface for indirect prompt injection.
- Ingestion points: The agent ingests campaign results and performance evidence as described in the "Process" and "Do" sections of SKILL.md.
- Boundary markers: There are no explicit delimiters or specific instructions provided to the agent to distinguish user-provided data from its primary instructions.
- Capability inventory: The skill uses a Node.js environment to execute a state-check script.
- Sanitization: The skill does not mention any validation, filtering, or escaping mechanisms for the campaign data before it is processed.
Audit Metadata