skills/lawve-ai/awesome-legal-skills/gdpr-privacy-notice-eu-oliver-schmidt-prietz/Gen Agent Trust Hub
gdpr-privacy-notice-eu-oliver-schmidt-prietz
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting and processing untrusted data, specifically user-provided business descriptions and existing document templates, to generate privacy notices. This design inherently presents a surface for indirect prompt injection attacks.
- Ingestion points: User instructions, business data provided during the intake process, and user-supplied .docx templates (SKILL.md Step 1).
- Boundary markers: The skill does not implement specific boundary markers or 'ignore' instructions for the content of user-provided templates; it specifically instructs the agent to preserve their structure and wording.
- Capability inventory: The skill utilizes an external docx tool to create and modify professional documents.
- Sanitization: There is no evidence of automated sanitization or filtering of the user-provided data before it is incorporated into the generation process.
- [METADATA_POISONING]: There is a lack of consistency regarding the skill's authorship. While the system context identifies the author as lawve-ai, the skill's internal documentation and metadata (SKILL.md, README.md) attribute the work to Oliver Schmidt-Prietz and OneZero Legal. This discrepancy impacts the clarity of accountability for the skill's content.
Audit Metadata