lgpd-privacy-policy
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data from various project files to generate a privacy policy draft, creating a surface for instructions embedded in those files to influence agent behavior.
- Ingestion points: The skill instructions direct the agent to read data from
.lgpd/ROPA.md,data-map.md,legal-basis.md,encarregado.md,retention.md, and files within thetransfers/directory. - Boundary markers: There are no specific instructions or delimiters provided to ensure the agent ignores or sanitizes potential instructions contained within the ingested documentation files.
- Capability inventory: The skill utilizes the agent's ability to read multiple files from the local filesystem and write new markdown files to the
.lgpd/policies/directory. - Sanitization: A mandatory human checkpoint and legal review process are explicitly required before any generated policy can be moved from draft to final status, providing a significant safeguard against automated misuse.
Audit Metadata