k2f-media-kit
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install a dependency using the command
npx skills add suzheng/k2f --skill k2f. This resource belongs to the same vendor as the skill author. - [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting untrusted external data such as company facts, leadership bios, product specifications, and launch quotes to generate the media kit.
- Ingestion points: Workflow Step 1 involves gathering verified company, product, and leadership inputs, including third-party quotes and customer names.
- Boundary markers: The skill suggests using stubs like
NEEDS USER INPUTorTBDfor missing data, but does not specify technical delimiters for the agent when processing these inputs into the final document. - Capability inventory: The skill uses the
k2ftool to pack and export the final content to formats like PDF. - Sanitization: The instructions emphasize manual verification and permission checks for logos and quotes, which provides a procedural layer of safety against malicious input.
Audit Metadata