entity-compliance
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were detected. The skill demonstrates high security maturity by implementing proactive defenses such as formula injection protection and role-based authorization checks before performing consequential legal actions.
- [PROMPT_INJECTION]: The skill processes untrusted external data via user-uploaded compliance reports (Mode 3b), creating a surface for indirect prompt injection. This is addressed through the skill's specific output sanitization and manual verification steps.
- Ingestion points: User-uploaded PDF/CSV/Excel reports (SKILL.md, Mode 3b); entity list configuration (SKILL.md, Step 1).
- Boundary markers: Not explicitly defined in the file parsing logic, though instructional context limits the impact of parsed data.
- Capability inventory: File read/write access to localized configuration directories (~/.claude/...); structured data export (CSV/Markdown).
- Sanitization: Explicitly implements formula injection defense by prepending a single quote to cells starting with risky characters (=, +, -, @) during export operations.
Audit Metadata