catalyst-orchestrator
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The framework is designed to ingest and strictly adhere to an external 'brand-context.md' file, which is explicitly permitted to override the agent's default operational constraints. This creates a surface for indirect prompt injection if the source file contains adversarial instructions.
- Ingestion points: The skill looks for 'brand-context.md' in the project root, '.claude/', and 'docs/' folders. It also ingests content from user-specified websites and existing marketing assets.
- Boundary markers: The instructions lack specific delimiters or 'ignore' instructions for the ingested content, increasing the risk of the agent obeying instructions embedded within the data.
- Capability inventory: The skill primarily generates marketing plans, strategy documents, and content; no dangerous system-level capabilities (such as shell access, network requests, or file system modifications) were identified in the provided files.
- Sanitization: The instructions mandate that the ingested content be treated as 'binding,' with no provision for validation or filtering of the external content for malicious patterns.
Audit Metadata