content-write
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the 'Idea Pool' and external Notion strategy documents to generate post content. This creates a surface where instructions embedded in those inputs could potentially override the skill's logic.
- Ingestion points: The skill reads from the
Idea Pool(hook draft, pillar, funnel, notes) and Notion Strategy (Section 6 Voice) via theSKILL.mdinstructions. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present when interpolating idea data into the prompt.
- Capability inventory: The agent has capabilities to write to the
Posts DB, update theIdea Pool, and send data to an externalTelegramchannel. - Sanitization: There is no evidence of sanitization or validation of the input data to prevent prompt injection; the 'humanize' step focuses on linguistic style rather than security.
- [DATA_EXFILTRATION]: The skill includes functionality to send the final post text and creative links to an external Telegram channel using a token or n8n integration.
- Network operations: The instructions specify sending drafted content to a 'LinkedIn Drafts' channel on Telegram. While Telegram is a well-known service, this represents a path for data to leave the agent's primary environment.
Audit Metadata