launch-product-hunt

Pass

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill mentions companion utilities (launch-copy, launch-outreach, launch-analytics) and provides the user with an installation command: npx skills add https://github.com/ulpi-io/skills --skill <name>. This URL points to the vendor's own GitHub organization and is used for modular skill management.
  • [COMMAND_EXECUTION]: The instructions direct the agent to utilize the browse tool to visit the product's live landing page. This is used solely to ground the generated copy in actual product features and differentiators.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, presenting a theoretical attack surface.
  • Ingestion points: Retrieves content from external URLs using the browse tool and reads local project files such as README.md and project-context.md.
  • Boundary markers: The skill does not explicitly define delimiters to isolate external content from the prompt instructions.
  • Capability inventory: Accesses Read, Write, and Skill (delegation) tools, in addition to the browse capability.
  • Sanitization: No explicit sanitization or validation of the retrieved external content is specified before it is used to generate marketing assets.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 16, 2026, 10:12 AM
Security Audit — agent-trust-hub — launch-product-hunt