form-8832
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill processes highly sensitive Personal Identifiable Information (PII), including Employer Identification Numbers (EINs) and Social Security Numbers (SSNs), which are required for completing IRS Form 8832. The skill includes specific security protocols in
filing.mdinstructing the agent to never store these identifiers and to discard them immediately after use. - [COMMAND_EXECUTION]: The skill provides instructions for using system tools such as
pdftkand the Python librarypypdfto programmatically fill government PDF forms based on gathered user data. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user-supplied data, such as entity names and reasonable cause narratives, which are then interpolated into the final tax documents and filing summaries.
- Ingestion points: User inputs for entity name, EIN, owner list, and reasonable cause statement (SKILL.md, references/late-relief.md).
- Boundary markers: Disclaimers regarding tax advice and CPA review requirements are present in SKILL.md and throughout the reference files.
- Capability inventory: Writing draft files and preparing mailing packets using system tools (SKILL.md, filing.md).
- Sanitization: Explicit validation checks for eligibility and timing rules are integrated into the workflow (SKILL.md).
Audit Metadata