social-media-manager
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads and interprets data from multiple local files such as 'brand-style.md', 'content-calendar.md', and 'best-performers.md'. This ingestion of external data creates a surface for indirect prompt injection where instructions hidden in the content could attempt to override the orchestrator's behavior.
- Ingestion points: Phase 0 (Context Check) reads various markdown files from the 'context/', 'outputs/', and '.claude/' directories to determine the current project status.
- Boundary markers: The skill incorporates mandatory human-in-the-loop approval gates at every major handoff between component skills (Phase 1, 2, 3, and 4), significantly reducing the risk of autonomous execution of injected instructions.
- Capability inventory: The skill is authorized to read local project files, update workflow status files, and sequentially invoke nine other specialized sub-skills.
- Sanitization: The orchestrator does not perform explicit validation or sanitization of the content found within the markdown context files before using the information for workflow routing.
Audit Metadata