product-marketing-context
Warn
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: MEDIUMPROMPT_INJECTION
Full Analysis
- [Indirect Prompt Injection] (MEDIUM): The skill possesses a significant attack surface for indirect prompt injection by ingesting untrusted data from the local repository to influence its own logic and the content it writes to disk.\n
- Ingestion points: Step 2 (Gather Information) instructs the agent to read the repository's README, landing pages, marketing copy, and "any existing docs".\n
- Boundary markers: Absent. The instructions do not provide delimiters or warnings to the agent to ignore potential instructions embedded within the codebase files.\n
- Capability inventory: The agent has the capability to read any file in the repository and write to
.claude/product-marketing-context.md.\n - Sanitization: Absent. There is no validation or filtering of the content being read from the repository.\n
- Impact: An attacker who can influence the repository content (e.g., via a Pull Request) could embed hidden instructions that cause the agent to generate a poisoned context document. Since other marketing skills are designed to reference this document, the injection can propagate downstream to other tools.
Audit Metadata