brand-voice-governance
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: A comprehensive analysis of the skill's instructions and the associated Node.js script found no malicious patterns, prompt injections, or obfuscation techniques.
- [COMMAND_EXECUTION]: The skill executes a local script, voice-check.js, to perform text analysis. The script is dependency-free, does not perform network requests, and handles input through standard JSON parsing without the use of dangerous functions like eval().
- [DATA_EXPOSURE]: The skill accesses local marketing documentation (e.g., .agents/product-marketing.md) to establish the voice profile. This data usage is confined to the local execution environment for the purpose of governance auditing and does not involve exfiltration to external domains.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input text and third-party brand briefs to perform its audit.
- Ingestion points: User-provided text and brand briefs are ingested via JSON arguments to the voice-check.js script.
- Boundary markers: The script processes input by splitting it into discrete text blocks and matching against literal strings or regex patterns, reducing the likelihood of instruction-based overrides within the data.
- Capability inventory: The skill uses node to run local analysis; it lacks the ability to write to sensitive system files or access the network.
- Sanitization: Inputs are parsed as standard JSON, and text analysis is performed using literal string matching and established heuristic formulas (Flesch–Kincaid grade levels).
Audit Metadata