uk-gdpr-compliance
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content such as code repositories, diffs, and legal documents which could contain embedded instructions.
- Ingestion points: Code, architecture descriptions, and various compliance-related documents (notices, banners, contracts) in references/code-review-checklist.md and references/document-review-checklist.md.
- Boundary markers: Not explicitly defined for the input data within the prompts.
- Capability inventory: Shell command execution via
rg(ripgrep) and file system writes for saving reports. - Sanitization: The skill contains specific instructions in SKILL.md to 'describe personal data by category and location, keeping real values out of the report', which mitigates the risk of data leakage even if the agent is influenced by the data.
- [COMMAND_EXECUTION]: The skill utilizes
rg(ripgrep) shell commands in references/code-review-checklist.md to search for sensitive data patterns. This usage is transparent, well-defined, and limited to the primary function of the skill (discovering personal data fields in a codebase).
Audit Metadata