citation-grounding-pl
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [REMOTE_CODE_EXECUTION]: No remote code execution patterns or unverified dependencies were detected. The core verification script (
ground-citations.mjs) is explicitly described as 'zero-dep' and uses only standard Node.js built-in modules (fs,url). - [DATA_EXFILTRATION]: The skill operates entirely locally with
data-residency: local. It does not contain network calls for data transmission. References to external databases (SAOS, EUR-Lex) are handled via companion skills or by the user providing documentation, rather than by the skill itself making direct network connections. - [OBFUSCATION]: The skill includes code designed to detect and remove obfuscation (such as zero-width characters U+200B/U+200C/U+200D and BOM) during text normalization to ensure accurate verification. No malicious obfuscation was found in the skill's own instructions or scripts.
- [INDIRECT_PROMPT_INJECTION]: While the skill ingests untrusted legal texts for verification, it does not use an LLM for the 'mechanical' verification phase (using string matching instead), which effectively mitigates the risk of indirect prompt injection during its primary execution path.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials or API keys were detected. The skill uses placeholders (e.g.,
II CSK NN/RR) for demonstration purposes.
Audit Metadata