compliance-verification
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data (contract drafts or business behavior descriptions) provided by the user in Step 1. This creates a surface for indirect prompt injection if the input contains malicious instructions designed to override the agent's behavior.
- Ingestion points: User-provided contract text in
SKILL.mdStep 1. - Boundary markers: Absent. The skill does not instruct the agent to use specific delimiters (like XML tags or triple quotes) to isolate the contract text from its instructions.
- Capability inventory: Uses
legal-researchandtaiwan-legal-dbMCP tools for searching laws and judgments. No high-risk capabilities like file system writes or arbitrary shell execution are defined within this skill. - Sanitization: Absent. No validation or filtering of the input text is performed before processing.
Audit Metadata