sms
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a set of instructional documents and references intended to help users design SMS marketing campaigns. It does not contain executable code, suspicious network requests, or obfuscated content. All external service references (e.g., Klaviyo, Twilio, Postscript, Attentive) are well-known, legitimate technology providers in the marketing space.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a potential surface for indirect prompt injection through the ingestion of user-provided business context.
- Ingestion points: Context gathering section in
SKILL.mdwhere the agent asks for business type, current state, and goals. - Boundary markers: The skill uses structured headers and bullet points to gather information but lacks explicit delimiters (like XML tags) or instructions to disregard potential commands embedded in user-supplied data.
- Capability inventory: The skill is limited to generating text-based strategies and copy templates. No shell commands, file system access, or network execution capabilities are defined or utilized within the provided skill files.
- Sanitization: There is no specific evidence of input sanitization or filtering for the business context data, but the lack of dangerous tools minimizes the risk.
Audit Metadata