gdpr-breach-72h-en
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill utilizes the
Bashtool to execute a local Python script (scripts/gdpr_deadlines.py). This script is a clerical aid for calculating date-based deadlines (72 hours for breaches, 1-3 months for DSARs). A review of the source code confirms it uses only Python standard libraries, lacks network or disk-write capabilities, and operates only on user-provided timestamps. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied incident details, creating an ingestion surface for potentially malicious instructions.
- Ingestion points: User-provided breach descriptions and awareness timestamps (SKILL.md).
- Boundary markers: None explicitly defined in the instructions to separate data from instructions.
- Capability inventory: The skill has access to
Bash(for the local deadline script) andReadtools. - Sanitization: No input sanitization is performed by the skill instructions.
- Risk Assessment: The risk is addressed by the explicit requirement for human approval of all drafts and the limited, non-networked capabilities of the provided tools.
Audit Metadata