etsi-drafting
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [NO_CODE]: The skill consists exclusively of instructional markdown and reference materials, with no executable scripts or code components provided.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to facilitate the editing and drafting of ETSI deliverable documents (.docx), creating an inherent attack surface for indirect prompt injection.
- Ingestion points: Processes and edits Word documents (.docx) provided by users or downloaded as skeletons (SKILL.md).
- Boundary markers: Absent. No specific delimiters or instructions to disregard embedded commands in the documents are present.
- Capability inventory: References the use of
officeclifor advanced document operations such as field code management and "tab-run injection" (SKILL.md). - Sanitization: Absent. The instructions do not define methods for sanitizing or validating document content against malicious instructions.
- [EXTERNAL_DOWNLOADS]: The skill provides links to download document templates from the official ETSI portal (
portal.etsi.org). These downloads are from a well-known and reputable standards organization and are used for their intended purpose.
Audit Metadata