evidence-artifact-collector
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to run a local generator script,plugins/grc-engineer/scripts/collect-evidence.js, which is consistent with its primary purpose of generating audit artifacts. - [DYNAMIC_EXECUTION]: The skill produces Python and Bash scripts dynamically based on user-supplied control IDs or descriptions.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided strings to generate specialized scripts.
- Ingestion points: User input provided as arguments to the evidence collection script in SKILL.md.
- Boundary markers: Not explicitly defined in the documentation.
- Capability inventory: The skill has access to shell and file management tools (
Bash,Write,Edit,Read). - Sanitization: Standard generation patterns are used; specific sanitization logic resides in the generator script itself.
Audit Metadata