810-regulations-eu-mifid-ii
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external Java enterprise evidence, such as source code, configurations, and logs. This creates a potential surface for indirect prompt injection if malicious instructions are embedded in the analyzed data.\n
- Ingestion points: The workflow (SKILL.md) and questionnaire (assets/questions/810-mifid-ii-engineering-review-questionnaire.md) guide the agent to review 'trusted local project evidence' and Java code implementations.\n
- Boundary markers: The skill employs a strict 20-question checklist and a pre-defined report template to ensure the agent's output remains within regulated bounds and relies only on facts.\n
- Capability inventory: The agent's role is restricted to reviewing and reporting; no specific tools for network transmission or code execution on the ingested data are defined.\n
- Sanitization: The skill contains multiple explicit instructions to redact passwords, API keys, and trading secrets using the [REDACTED_SECRET] placeholder.\n- [EXTERNAL_DOWNLOADS]: The skill provides reference links to official regulatory documentation hosted on the European Union's portal (eur-lex.europa.eu). This is a well-known and trusted service used to provide the necessary legal context for compliance reviews.
Audit Metadata