recall
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local script
intelligence-graph.pywith user-defined parameters to query marketing data. This is a core function of the skill and aligns with its stated purpose. - [SAFE]: The skill reads brand-related data and SOPs from the
~/.claude-marketing/directory. These files are application-specific and their access does not expose sensitive system information like SSH keys or environment variables. - [SAFE]: The skill processes data from local brand profiles and SOPs, which constitutes an indirect prompt injection surface. 1. Ingestion points:
~/.claude-marketing/brands/profile.json,~/.claude-marketing/sops/. 2. Boundary markers: Absent. 3. Capability inventory: Execution ofintelligence-graph.py. 4. Sanitization: Absent. The risk is considered safe as the data sources are local to the user's environment and specific to the application's domain.
Audit Metadata