compliance-auditor
Pass
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONNO_CODEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several Python scripts (e.g., scripts/check_gdpr.py, scripts/validate_hipaa.py) and shell commands (grep) to perform audits. These commands are intended to scan the local file system for sensitive compliance evidence.
- [NO_CODE]: Functional components described in SKILL.md, including the entire scripts/ directory and the config/compliance.yaml file, are missing from the skill package. This inconsistency prevents a complete security evaluation of the underlying logic.
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes untrusted data. Ingestion points: Project files, configurations, and policies referenced in SKILL.md. Boundary markers: Absent; no delimiters or instructions are provided to distinguish between audit results and instructions. Capability inventory: Traversal of local files, grep searching, and execution of Python scripts for report generation. Sanitization: Absent; no validation or escaping of audited content is described.
Audit Metadata