reviewer-visit-memo
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is exceptionally well-documented, providing a detailed provenance trail (PROVENANCE.md and the provenance/ directory) that traces its logic back to specific Chinese banking regulations (e.g., CBRC/CBIRC guidelines). This transparency supports its legitimate business purpose.
- [COMMAND_EXECUTION]: The skill includes a Python script (
scripts/validate_visit_memo.py) intended for data validation. This script relies exclusively on the Python standard library, contains no dangerous subprocess calls or network operations, and serves a benign functional purpose. - [DATA_EXFILTRATION]: While the skill is designed to handle sensitive banking information (CM reports, ECIF data), all data access is defined through internal vendor APIs and interfaces. There are no hardcoded credentials or unauthorized network calls targeting external domains.
- [EXTERNAL_DOWNLOADS]: The
scripts/requirements.txtfile explicitly states that there are no external dependencies, utilizing only the Python standard library. This significantly reduces the supply chain risk profile. - [PROMPT_INJECTION]: The skill's instructions are strictly bound to credit approval workflows. It includes robust constraints (e.g., fact-first recording, mandatory red-flag reporting) and lacks any patterns typically associated with jailbreaking or safety bypass attempts.
Audit Metadata