vendor-due-diligence-patrick-munro
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: The skill consists entirely of markdown instructions, checklists, and templates for performing vendor due diligence. It does not include any scripts, executable commands, or logic that performs actions on the host system.
- [INDIRECT_PROMPT_INJECTION]: The skill provides a framework for analyzing external data (vendor-provided documents like financial statements and security certifications). While this constitutes an ingestion point for untrusted data, the skill itself lacks any dangerous capabilities—such as network exfiltration, file system modifications, or command execution—that could be exploited via malicious content embedded in those documents.
- [SAFE]: The content is limited to professional guidance regarding regulatory frameworks such as DORA, NIS2, and GDPR. No obfuscation, prompt injection, or suspicious persistence mechanisms were detected.
Audit Metadata