launch-product-hunt
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill mentions companion utilities (launch-copy, launch-outreach, launch-analytics) and provides the user with an installation command:
npx skills add https://github.com/ulpi-io/skills --skill <name>. This URL points to the vendor's own GitHub organization and is used for modular skill management. - [COMMAND_EXECUTION]: The instructions direct the agent to utilize the
browsetool to visit the product's live landing page. This is used solely to ground the generated copy in actual product features and differentiators. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, presenting a theoretical attack surface.
- Ingestion points: Retrieves content from external URLs using the
browsetool and reads local project files such asREADME.mdandproject-context.md. - Boundary markers: The skill does not explicitly define delimiters to isolate external content from the prompt instructions.
- Capability inventory: Accesses
Read,Write, andSkill(delegation) tools, in addition to thebrowsecapability. - Sanitization: No explicit sanitization or validation of the retrieved external content is specified before it is used to generate marketing assets.
Audit Metadata