internal-audit-planning
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [NO_CODE]: The skill is composed entirely of markdown instructions and templates. It does not contain any scripts (Python, JavaScript, shell) or configuration files that would execute commands or perform automated operations.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a process for analyzing external organizational data, which represents a potential surface for indirect prompt injection if the inputs contain malicious instructions.
- Ingestion points: The framework processes "Prior Audit Results", "Risk Assessment Output", and "Stakeholder Priorities" as key inputs in SKILL.md.
- Capability inventory: The skill involves building an audit universe, prioritizing risks, and generating reports.
- Boundary markers: There are no explicit delimiters or instructions to the agent to ignore embedded commands within the input data.
- Sanitization: The instructions do not specify a requirement for validating or cleaning data retrieved from external risk registers or previous audit documents.
Audit Metadata