pricing
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill includes instructions to read context from external files, which establishes an attack surface for indirect prompt injection if those files are controlled by an untrusted party.\n
- Ingestion points:
.agents/product-marketing.md,.claude/product-marketing.md, andproduct-marketing-context.md(referenced in SKILL.md).\n - Boundary markers: No specific delimiters or safety warnings are provided for processing these external files.\n
- Capability inventory: The skill does not possess dangerous capabilities; its operations are limited to providing strategic advice and generating text.\n
- Sanitization: No validation or sanitization of the file content is performed before processing.\n- [SAFE]: No other security concerns were identified. The skill's components are static markdown and JSON files containing legitimate business strategy content and evaluation tests. There is no evidence of obfuscation, remote code execution, or credential exposure.
Audit Metadata