developer-marketing-ops
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a process (Step 0) where the agent is required to locate and read a file named
brand-context.mdfrom the project root or specified subdirectories. - Ingestion points: The skill ingests data from
brand-context.md,/.claude/brand-context.md, or/docs/brand-context.md. - Boundary markers: The skill lacks boundary markers for this ingested data and explicitly instructs the agent that the "Rules for agents reading this file" section in that external document "overrides an agent's own defaults." This creates a clear path for instructions in user-controlled files to bypass the agent's pre-configured constraints.
- Capability inventory: The agent typically operates with capabilities for filesystem access, shell execution, and network operations, which could be leveraged if the agent is successfully injected via a malicious brand context file.
- Sanitization: No validation, sanitization, or filtering of the content within the
brand-context.mdfile is mentioned before the agent adopts its instructions as binding.
Audit Metadata