positioning-and-messaging
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data retrieved via web tools and user-provided text, creating a potential surface for indirect prompt injection.
- Ingestion points: Untrusted content enters the context through
web_fetchoperations and user-supplied files or text. - Boundary markers: The skill includes a robust defense in Section 0, explicitly instructing the agent to treat fetched or uploaded content as data only and to disregard any instructions found within them.
- Capability inventory: The skill uses
web_searchandweb_fetchto gather market and competitor information. - Sanitization: The agent is instructed to provide a specific one-line warning if it encounters instructions in data and to refuse execution of those instructions.
- [EXTERNAL_DOWNLOADS]: The skill references external resources linked to the vendor's own infrastructure for additional functionality and support.
- Evidence: Mentions an MCP server (
@shashwatgtmalpha/impact-mcp-server) and the author's website (gtmexpert.com). These resources are consistent with the vendor's provided identity and purpose.
Audit Metadata