pci-dss-compliance
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill defines an attack surface for indirect prompt injection through the processing of untrusted data in payment security workflows.
- Ingestion points: Methods within PANProtection (e.g., mask_pan, encrypt_pan) and TransmissionSecurity (e.g., validate_tls_config) accept external strings as input in SKILL.md.
- Boundary markers: The template code lacks explicit delimiters or instructions to treat data as untrusted, which could lead to an agent following instructions embedded in the input.
- Capability inventory: The skill has the capability to establish network connections using socket.create_connection and perform cryptographic operations using the cryptography library as seen in SKILL.md.
- Sanitization: No input validation or sanitization logic is implemented in the provided Python snippets to mitigate malicious content in the account data or endpoint parameters.
Audit Metadata