mls-listing-craft
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or security vulnerabilities were detected. The skill's operations are limited to text generation and local file creation for listing packages.
- [PROMPT_INJECTION]: The skill processes untrusted user data (property facts and photo descriptions) to generate listing copy. This creates a surface for indirect prompt injection, though the risk is minimized by the skill's restricted output format and compliance logic.
- Ingestion points: Property facts (address, features, price) and descriptors extracted from user-attached photos (SKILL.md).
- Boundary markers: The skill does not define explicit delimiters (e.g., XML tags or unique markers) to isolate user-provided data from the agent's core instructions.
- Capability inventory: The skill utilizes file system write capabilities to create a directory structure and save listing files locally (Phase 5).
- Sanitization: The skill implements a 'Fair Housing Compliance Gate' (Phase 1) designed to filter discriminatory language patterns from the final generated output.
Audit Metadata