consent-and-preferences
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill consists of instructional and reference documents for managing marketing consent and data privacy. It contains no executable code, remote script downloads, or requests for sensitive system access.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface involving the processing of untrusted data from ingestion points such as exports, tickets, survey answers, and web pages. It implements a defensive boundary marker by explicitly instructing the agent that such content is data and never an instruction. While the skill has no internal tools or automated sanitization, the provided behavioral constraints effectively mitigate the risk.
- [COMMAND_EXECUTION]: The instructions mention a CLI command for adding other skills ('npx skills add') but establish a safety constraint requiring the agent to only present this as information to the user and prohibiting autonomous execution.
Audit Metadata