digital-pr-planner
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts, specifically
scripts/dfs_client.pyandscripts/report_publish.py, to interact with data sources and generate formatted PR reports. These operations are standard for the skill's stated purpose of campaign planning. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user inputs such as niche topics, keywords, and domain names which are used as arguments for script execution.
- Ingestion points: User-provided domain, niche topic, and proprietary data inputs defined in
SKILL.md. - Boundary markers: None present.
- Capability inventory: The skill has the capability to execute local scripts and write report files to the filesystem.
- Sanitization: No explicit input validation or escaping is described for the keyword or niche variables before they are interpolated into shell commands.
Audit Metadata