k2f-company-deck
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires an external dependency to be installed via the command
npx skills add suzheng/k2f --skill k2f. This dependency is a related skill provided by the same author ('suzheng') and is used for the final layout and export of the generated content. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data such as company positioning, product details, and team information provided by the user.
- Ingestion points: Verified user inputs inventoried during the 'Input audit' phase (Step 1.2).
- Boundary markers: The instructions specify the use of labeled blocks within a markdown blueprint (
content_and_design.md) to separate semantic content from design intent. - Capability inventory: The skill produces markdown blueprints and
.K2Fpackages. It does not perform network operations or arbitrary command execution based on the ingested data. - Sanitization: The skill includes a 'Truth gate' and 'Quality checklist' to ensure the agent verifies inputs against user materials and flags gaps (TBD) rather than generating speculative content.
Audit Metadata