privacy-compliance
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external content such as privacy policies, Data Processing Agreements (DPAs), and codebases for compliance auditing.\n- Ingestion points: Workflows ingest user-provided documents and code for analysis (e.g., SKILL.md Workflows 1, 3, 9, 11, and 12).\n- Boundary markers: The skill contains explicit 'Safety Rules' and disclaimers to treat output as advisory and redact PII.\n- Capability inventory: The agent is instructed to read files, scan schemas, and generate compliance reports.\n- Sanitization: Safety Rule #1 mandates redaction of actual PII in outputs.\n- [SAFE]: The skill includes a structural validation script
scripts/validate_skill.pywhich only uses Python standard libraries to verify the integrity of the skill package.\n- [SAFE]: External references in SKILL.md and references/privacy-regulations.md point to official regulatory bodies and well-known documentation sites.
Audit Metadata