skills/suzheng/k2f/k2f-media-kit/Gen Agent Trust Hub

k2f-media-kit

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install a dependency using the command npx skills add suzheng/k2f --skill k2f. This resource belongs to the same vendor as the skill author.
  • [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting untrusted external data such as company facts, leadership bios, product specifications, and launch quotes to generate the media kit.
  • Ingestion points: Workflow Step 1 involves gathering verified company, product, and leadership inputs, including third-party quotes and customer names.
  • Boundary markers: The skill suggests using stubs like NEEDS USER INPUT or TBD for missing data, but does not specify technical delimiters for the agent when processing these inputs into the final document.
  • Capability inventory: The skill uses the k2f tool to pack and export the final content to formats like PDF.
  • Sanitization: The instructions emphasize manual verification and permission checks for logos and quotes, which provides a procedural layer of safety against malicious input.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 01:10 PM