form-1095-a
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides structured guidance based on official IRS tax forms and publications. No malicious behavior, prompt injection, or suspicious obfuscation was detected across the 11 analyzed files.- [SAFE]: All external references point to trusted domains, including official U.S. government websites (irs.gov, healthcare.gov, hhs.gov) and the vendor's own verified blog (jupid.com).- [SAFE]: The skill incorporates security best practices by instructing the agent to never persist sensitive taxpayer data like Social Security Numbers or bank details beyond the active filing session.- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes user-supplied tax values to generate output drafts and guide filing processes.
- Ingestion points: User-provided values for Form 1095-A boxes, household income, and family composition (SKILL.md).
- Boundary markers: The instructions use clear procedural steps, but the skill does not explicitly define delimiters for user-provided data within its interpolation logic.
- Capability inventory: The skill produces a markdown draft for the user and outlines browser-based filing through external platforms (filing.md).
- Sanitization: No explicit data sanitization or escaping mechanisms are described, though the system relies on human review of the generated tax draft before submission.
Audit Metadata