805-regulations-eu-cyber-resilience-act
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is designed as a set of analytical guidelines and templates. It explicitly restricts the agent to using bundled reference files rather than fetching external web content, which mitigates risks associated with data poisoning or indirect prompt injection from remote sources.
- [SAFE]: Instructions emphasize security best practices such as sensitive-data-safe logging, data minimization, and least privilege. It avoids any operations involving network exfiltration, sensitive file access, or command execution.
- [SAFE]: The Java code examples provided in the references are strictly for illustrative purposes within markdown blocks and are not intended for or capable of execution in the agent's environment.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data for analysis. Ingestion points: User-provided Java code and evidence (SKILL.md Workflow). Boundary markers: Explicit instructions to use 'BUNDLED REFERENCES ONLY' and 'SCOPE FIRST' limit the influence of external data. Capability inventory: No tools for network, file-write, or shell execution are present. Sanitization: The 'SENSITIVE-DATA-SAFE LOGGING' constraint in SKILL.md prevents the accidental leakage of sensitive information extracted from the analyzed source code.
Audit Metadata