social-performance-review
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, creating a surface for indirect prompt injection attacks.
- Ingestion points: Data enters the agent context through user-provided CSV exports (Phase 2), manual text input, and external web content scraped from competitor social media handles using the Firecrawl and Playwright MCP tools (Phase 4).
- Boundary markers: The instructions do not define boundary markers or delimiters to isolate untrusted content (e.g., post captions or scraped text), nor do they provide instructions to the model to ignore potential commands embedded within that data.
- Capability inventory: The skill possesses file-write capabilities, updating local files such as
context/best-performers.mdandcontext/review-history.md. It also has network access via scraping tools. Malicious content stored incontext/best-performers.mdcould influence future executions of this or related skills like/caption-writer. - Sanitization: There is no evidence of sanitization, filtering, or validation of the ingested strings before they are incorporated into reports or context files.
Audit Metadata