partnerships-and-co-marketing
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data concerning potential partners (names, goals, product descriptions) and campaign results (leads, pipeline). This input could be manipulated to include malicious instructions intended to bias the agent's evaluation results.
- Ingestion points: Input fields for partner candidates and co-marketing goals as defined in the SKILL.md and through user prompts.
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore-instructions' blocks when interpolating partner data into the agent's context.
- Capability inventory: The skill executes a local Node.js engine (
resources/partner-fit.js) to generate verdicts and scoring metrics. - Sanitization: The provided script validates the presence of required JSON keys but does not sanitize the text content of those values for potential prompt injection patterns.
- [COMMAND_EXECUTION]: The skill instructs the agent to run a local Node.js script (
resources/partner-fit.js) to evaluate partnership fit. The script is bundled with the skill, performs logical calculations, and does not exhibit dangerous behaviors such as unauthorized file system access or network exfiltration.
Audit Metadata