onboarding-cro
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions specify reading a local file
.claude/product-marketing-context.mdto obtain context about the product being optimized. While this constitutes a data ingestion point, the skill lacks any executable capabilities or tools that could be exploited by malicious content within that context file. - Ingestion points:
.claude/product-marketing-context.md(referenced in SKILL.md) - Boundary markers: None explicitly defined
- Capability inventory: No file writes, network operations, or shell commands are utilized by the skill scripts
- Sanitization: Not applicable as no downstream execution occurs
- [SAFE]: No security issues were detected. The skill provides static advice, audit frameworks, and experiment suggestions related to marketing and user experience.
Audit Metadata