turn-this-into-a-thread
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external, untrusted content which could contain hidden malicious instructions intended to manipulate the agent's behavior.
- Ingestion points: Processes long ideas, transcripts, articles, and drafts provided by the user in
SKILL.mdworkflow. - Boundary markers: The instructions lack explicit boundary markers or delimiters (e.g., XML tags or triple quotes) to separate untrusted content from the system instructions.
- Capability inventory: The skill can perform actions via the
publish_postandschedule_posttools, which write to external social media platforms. - Sanitization: There is no evidence of input validation or sanitization of the provided text before it is used to generate tweets or interact with tools.
- [DATA_EXFILTRATION]: The skill involves network operations that send data to an external domain (
voicemoat.com). - Evidence: The documentation explicitly states that when the VoiceMoat connector is used, post text and account data are sent to
voicemoat.com. While this is part of the skill's intended functionality, it constitutes a data transfer to a non-whitelisted service. - [COMMAND_EXECUTION]: The skill leverages external tools to perform sensitive actions on the user's behalf.
- Evidence: The tools
publish_postandschedule_postallow the agent to post to real-world Twitter/X or LinkedIn accounts. The skill includes a security control requiring a second call with a one-time code and user confirmation, which mitigates the risk of automated unauthorized execution.
Audit Metadata