product-marketing-context
Pass
Audited by Gen Agent Trust Hub on Mar 7, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [NO_CODE]: The skill is implemented entirely as a set of markdown instructions for the AI agent and does not include any Python scripts, Node.js packages, or binary executables.
- [SAFE]: File system interactions are restricted to reading project documentation and writing to the .agents/product-marketing-context.md file, which aligns with the skill's intended purpose and does not pose a high security risk.
- [PROMPT_INJECTION]: The 'auto-draft' workflow is susceptible to indirect prompt injection because it instructs the agent to process content from various repository files like READMEs and marketing copy. Maliciously crafted instructions within those files could attempt to influence the agent's behavior during the drafting process.
- Ingestion points: Step 2 of the workflow specifies reading the README, landing pages, marketing copy, and package.json.
- Boundary markers: The skill does not define clear delimiters or 'ignore' instructions for the data being read from the codebase.
- Capability inventory: The agent has the ability to read project files and write the product-marketing-context.md file.
- Sanitization: No explicit sanitization or validation of the ingested codebase content is mentioned in the instructions.
Audit Metadata