nmt-craft-go-to-market
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves processing content from external, untrusted sources, creating a potential surface for indirect prompt injection where malicious instructions hidden in data could influence the agent.\n
- Ingestion points: The skill ingests user-provided materials like Notion exports and interview notes, as well as external web content from platforms like Reddit, G2, and Product Hunt.\n
- Boundary markers: The instructions do not define specific delimiters or warnings to the agent to ignore instructions embedded within the ingested data.\n
- Capability inventory: The skill possesses capabilities for local file writes (storing results) and network access (performing web research in Deep mode).\n
- Sanitization: There is no evidence of specific sanitization or filtering logic applied to external data before it is processed by the LLM.\n- [EXTERNAL_DOWNLOADS]: During its 'Deep' mode, the skill suggests the use of external web research services to collect data.\n
- Evidence: The documentation points to well-known services such as Firecrawl and Exa to facilitate the mining of customer feedback and competitor information.
Audit Metadata