privacy-compliance
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (
ls) targeting specific hidden directories in the user's home and current folder (e.g.,~/.claude/skills/,.agent/skills/) to identify if recommended companion skills are present. - [EXTERNAL_DOWNLOADS]: The documentation directs the user to install additional components using
npx skills, which fetches and executes code from theAbsolutelySkilledvendor repository. This is part of the standard skill management workflow. - [PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection as it is designed to process and review untrusted external data, such as privacy policies and data subject request exports.
- Ingestion points: Reviewing privacy policies and processing JSON/CSV data exports as specified in Common Tasks 4 and 5 of SKILL.md.
- Boundary markers: No explicit delimiters or instructions to ignore embedded instructions are defined for the handled content.
- Capability inventory: Access to shell command execution (
ls) and potential file system access for data exports. - Sanitization: No specific data validation or sanitization procedures are described for the ingestion of external privacy-related documents.
Audit Metadata