808-regulations-eu-digital-markets-act
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data including Java source code, system logs, configuration files, and API definitions to generate compliance reports. This creates an indirect prompt injection surface where malicious instructions embedded in the analyzed code or logs could potentially influence the agent's final report.
- Ingestion points: Workflow step 3 in
SKILL.mdidentifies a wide range of ingestion points: Java code, configuration, APIs, DTOs, repositories, schemas, migrations, Kafka messages, ranking code, feature flags, experiments, consent records, audit logs, metrics, traces, dashboards, and export jobs. - Boundary markers: The instructions do not define explicit boundary markers or delimiters for the agent to use when ingesting these external data sources.
- Capability inventory: The skill is primarily designed to perform analysis and generate a textual review report based on the provided template in
assets/reports/808-eu-digital-markets-act-engineering-review-report-template.md. - Sanitization: No specific sanitization or filtering logic is described for the external content before it is processed by the agent.
Audit Metadata