guidewire-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (such as claim evidence and reporter information) while possessing network and file modification capabilities.
- Ingestion points: External reporter data and evidence reason strings are processed in SKILL.md functions like intakeFnol and handleLateEvidence.
- Boundary markers: None explicitly defined in the logic for processing evidence text.
- Capability inventory: The skill uses Bash(curl:), Bash(jq:), Read, Write, and Edit.
- Sanitization: Standard API payload construction is shown, but no explicit sanitization of narrative evidence fields is demonstrated in the examples.
- [SAFE]: The skill provides technical documentation and code templates for Guidewire ClaimCenter API integrations.
- [SAFE]: Network operations are directed towards Guidewire official documentation and API endpoints (represented by the ${BASE} variable).
- [SAFE]: No sensitive data exposure, obfuscation, or unauthorized command execution patterns were identified.
Audit Metadata