create-marketing-kit
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a bundled Python script,
validate_campaign_kit.py, to verify the integrity and dimensions of generated marketing assets. The script parses image headers using standard libraries and incorporates robust path-traversal checks to ensure it only interacts with files within the intended campaign directory. - [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection by ingesting untrusted data from external product documentation and websites during the research phase.
- Ingestion points: Step 1 (SKILL.md) directs the agent to read the product README and website content.
- Boundary markers: The workflow mandates the creation of a 'claims ledger' that categorizes data as verified, inference, or unknown, providing a logical boundary for external information.
- Capability inventory: The agent has the capability to modify repository files (README/website) and execute a local validation script.
- Sanitization: The process includes a mandatory 'truth audit' and copy guardrails to filter out unsupported superlatives and ensure that all marketing claims are grounded in verified evidence.
Audit Metadata