nmt-product-requirements
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as customer interview notes and Notion exports. To mitigate the risk of indirect prompt injection, it uses an 'input-as-hypothesis gate' and tags imported data as '[user data]', ensuring that external content does not override core agent instructions.
- [EXTERNAL_DOWNLOADS]: In 'Deep mode', the skill utilizes subagents to perform web searches for market parity. The skill explicitly identifies the use of well-known services like Firecrawl and Exa for these tasks, which falls within the expected behavior for a research-oriented product tool.
- [SAFE]: The skill demonstrates best practices by clearly defining its scope, implementing validation-debt tracking, and restricting its methodology grounding to a public canon of documentation.
Audit Metadata