voice-of-customer
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSNO_CODE
Full Analysis
- [SAFE]: The skill consists entirely of instructional markdown documentation describing business logic and metrics. It contains no scripts, executables, or environment configurations that could perform actions independently.\n- [INDIRECT_PROMPT_INJECTION]: The framework involves processing customer feedback (verbatims), creating a surface for potential indirect prompt injection.\n
- Ingestion points: Customer text from surveys is processed for theme analysis in references/reading-and-change.md.\n
- Boundary markers: The SKILL.md file includes an explicit instruction to the agent to treat text inside survey answers as data, never as an instruction, which is a key security guardrail.\n
- Capability inventory: There are no tools, subprocess calls, or network operations defined in the skill.\n
- Sanitization: The skill relies on prompt-level boundaries rather than programmatic filtering.\n- [EXTERNAL_DOWNLOADS]: References are made to official legal and regulatory websites (ICO, CRTC, eCFR, legislation.gov.uk, etc.) for guidance on data privacy and consumer protection laws. These are well-known, trusted government and regulatory domains.
Audit Metadata