Skills
Navigate
skills/alirezarezvani/claude-skills/soc2-audit-prep/Gen Agent Trust Hub

soc2-audit-prep

Pass

Audited by Gen Agent Trust Hub on Nov 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell commands to run Python scripts (gap_analyzer.py, control_matrix_builder.py, evidence_tracker.py, and audit_simulator.py) stored in specific vendor and sibling skill directories. These are used to automate data analysis for audit readiness.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied JSON files, which creates an attack surface for indirect prompt injection. 1. Ingestion points: current_state.json, program.json, evidence_log.json, and soc2_scope.json are ingested by scripts defined in SKILL.md. 2. Boundary markers: The instructions do not specify any delimiters or instructions for the agent to ignore potentially malicious content within these files. 3. Capability inventory: The skill has the capability to execute shell commands using the python interpreter. 4. Sanitization: No specific sanitization, validation, or escaping logic is defined for the input data in the skill instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 7, 2026, 09:21 PM