brand-onboarding
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external websites and social media profiles to generate a style guide (
context/brand-style.md) that serves as a foundation for other creative skills. This creates a multi-step injection surface where malicious content on a scanned website could potentially influence the behavior of subsequent agents.\n - Ingestion points: The skill uses Playwright in Phase 1 to read content from a user-provided Website URL and Instagram handle. In Phase 3, it reads responses from a client-facing markdown document.\n
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore' commands to isolate the untrusted external data from the agent's logic.\n
- Capability inventory: The skill possesses file-write capabilities (writing to
context/brand-style.md,assets/, and the project root) and network access via the Playwright tool.\n - Sanitization: There is no evidence of filtering, escaping, or validating the text extracted from external websites before it is synthesized into the final output file.\n- [DATA_EXFILTRATION]: The skill performs network operations by navigating to external, non-whitelisted domains provided by the operator to capture screenshots and read page content via Playwright.
Audit Metadata