first-gap-assessment
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from a company's internal documentation, such as policies, ticket histories, and audit reports, to generate assessment registers.
- Ingestion points: Reads various local files and documents provided by the user to identify existing controls and gaps (Step 1).
- Boundary markers: The instructions explicitly direct the agent to use only "bare identifiers" and "short descriptions" and strictly forbid copying requirement text or full content into the final output, providing a functional boundary for data processing.
- Capability inventory: The skill generates local files (
gap-register.csv,gap-summary.md) and can interact with an external MCP server (https://account.ismscopilot.com/v1/account/mcp) to perform framework lookups. - Sanitization: The skill contains mandatory rules forbidding the opening, copying, or quoting of protected health information (PHI), personal data, or secrets, and explicitly instructs the agent to send only short, non-sensitive questions to the external framework lookup tool.
Audit Metadata