eva-preflight
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted natural language content and external materials, which presents an attack surface for instructions embedded in data. Ingestion points: Natural language drafts, Briefs, and third-party materials as described in SKILL.md and references/preflight/00_eva-preflight_发布前审核主控.md. Boundary markers: The skill explicitly mandates the use of a dedicated safety boundary module (shared/06_external-material-safety_外部材料安全边界.md). Capability inventory: The skill is restricted to reading local reference files and outputting textual judgments, with no file-writing or network capabilities. Sanitization: Instructions specifically state that any commands found within the audited content must be treated solely as evidence for analysis and not executed.
- [SAFE]: The skill follows best practices for least privilege and safety-first design, relying on read-only vendor-specific reference materials.
Audit Metadata