alterlab-kvkk-dmp
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-supplied project metadata (e.g., project title, retention period) that is interpolated into a generated plan skeleton.
- Ingestion points: User-provided arguments for the
kvkk_dmp_scaffold.pyscript. - Boundary markers: The output is structured as a markdown file, but there are no specific markers to prevent instructions within user metadata from being interpreted by subsequent agents.
- Capability inventory: The skill has
WriteandBashaccess to run the localized Python script and save outputs. - Sanitization: The script performs standard string interpolation without advanced sanitization for markdown control characters. However, given the skill's purpose as a documentation generator, this risk is considered negligible.
- [COMMAND_EXECUTION]: The skill utilizes a deterministic Python script (
scripts/kvkk_dmp_scaffold.py) to generate plan skeletons. The script is self-contained, relies solely on the Python standard library, and performs no network or sensitive file operations. - [EXTERNAL_DOWNLOADS]: The skill references official Turkish government domains (e.g., mevzuat.gov.tr, kvkk.gov.tr, resmigazete.gov.tr) as authoritative sources for legal text. These references are appropriate and target trusted official institutions.
Audit Metadata