mistral-data-handling
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill demonstrates secure secret management by instructing the use of environment variables (
process.env.MISTRAL_API_KEY) rather than hardcoding credentials. - [SAFE]: The primary purpose of the skill is defensive, providing robust regular expression patterns to identify and redact PII (email, phone numbers, SSN, credit card numbers, and IP addresses) before data is sent to external APIs.
- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for processing untrusted external data (user messages and training datasets) which are then used in network calls and file operations.
- Ingestion points: Data enters through the
messagesarray insafeChatCompletionand theinputPathfile insanitizeTrainingData(SKILL.md). - Boundary markers: The provided code snippets do not implement explicit boundary markers or delimiters for the data being passed to the Mistral API.
- Capability inventory: The skill templates utilize the Mistral API for network requests and
fs.createWriteStreamfor file system modifications. - Sanitization: Active sanitization is implemented via a multi-pattern
redactPIIfunction designed to prevent the exposure of sensitive information.
Audit Metadata