product-marketing
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill scans the local codebase (README, landing pages, marketing copy, package.json) to automatically draft a marketing context document. This creates a surface for indirect prompt injection if those files contain malicious instructions intended to manipulate the generated marketing document. However, the workflow includes a mandatory user review step before the document is saved, and the skill's capabilities are limited to file operations within the project directory.
- Ingestion points: Codebase files including README, package.json, and marketing documentation.
- Boundary markers: None explicitly defined in the prompt instructions.
- Capability inventory: File reading and writing within the project environment.
- Sanitization: No explicit sanitization or filtering of codebase content is mentioned.
Audit Metadata