skills/jeremylongshore/tons-of-skills-marketplace/assisting-with-soc2-audit-preparation/Gen Agent Trust Hub
assisting-with-soc2-audit-preparation
Warn
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/generate_soc2_report.pyincludes agenerate_scriptmethod that assembles Bash scripts from provided content and programmatically grants execution permissions usingchmod 0o755. - [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its design to process untrusted data from multiple sources without adequate safeguards.
- Ingestion points: Sensitive files such as security policies in
${CLAUDE_SKILL_DIR}/docs/, infrastructure-as-code files, and cloud provider audit logs (AWS CloudTrail, Azure Activity Log, GCP Audit Logs). - Boundary markers: The skill instructions do not define delimiters or specific instructions for the agent to ignore commands embedded within the analyzed documents.
- Capability inventory: The skill has capabilities to write files, execute
Bashcommands through scoped tool aliases, and generate executable shell scripts. - Sanitization: There is no evidence of sanitization or validation logic to prevent malicious input from being interpolated into generated scripts or reports.
Audit Metadata