nmt-market-research
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions include an update check mechanism that performs a network request to nextmovetheory.com. While the data sent is limited to a version string, this domain is not included in the standard whitelist for network operations.\n- [PROMPT_INJECTION]: The skill is designed to ingest and analyze external data from web sources (via WebFetch) and user-provided documents (via Read). This creates a surface for indirect prompt injection where malicious instructions could be embedded in the analyzed content.\n
- Ingestion points: User-supplied materials such as spreadsheets and strategy docs, and external competitor reviews retrieved from the web.\n
- Boundary markers: The skill utilizes [user data] tags and a structured "claims ledger" to distinguish user input from research data.\n
- Capability inventory: The skill can spawn subagents, perform network requests, and write files to the local filesystem.\n
- Sanitization: Implements a self-critic loop and methodology-specific validation gates to treat all external inputs as hypotheses rather than facts.
Audit Metadata