privacy-generator
Warn
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs the agent to scan local codebases and environment variables (such as .env files) specifically to find third-party API keys and configuration secrets. Accessing these sensitive files is a high-risk behavior that could lead to credential exposure if the agent's context is compromised.
- [INDIRECT_PROMPT_INJECTION]: The skill utilizes WebFetch to ingest data from external, untrusted websites. This creates a surface for indirect prompt injection, where malicious instructions hidden in a website's HTML or metadata could attempt to subvert the agent's behavior during the policy generation process.
- [EXTERNAL_DOWNLOADS]: The skill references several official regulatory and legal resources, including the California Attorney General's office (oag.ca.gov), the FTC, and NIST. These are well-known and trusted government sources.
Audit Metadata