puberty
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill processes user-supplied developmental reports (e.g., Tanner stages, menarche timing) and uses the
Writetool to store this information, creating an attack surface for indirect prompt injection. - Ingestion points: User input parsed in Step 1 of
SKILL.md(e.g., breast, pubic, testicular data). - Boundary markers: Absent. The instructions do not specify the use of delimiters or warnings to the agent to ignore instructions embedded in the user data.
- Capability inventory: The skill utilizes
ReadandWritetools to modify files in thedata/directory. - Sanitization: Absent. There is no logic described for filtering or escaping user-provided text before updating the JSON data structure.
- [DATA_EXFILTRATION]: While intended for its core functionality, the skill handles highly sensitive personal health and developmental data.
- Evidence: The skill collects and stores Tanner staging (B1-B5, P1-P5, G1-G5), menarche age, and testicular volumes in
data/puberty-tracker.jsonand timestamped record files. This concentration of sensitive information represents a risk if the agent environment is compromised.
Audit Metadata