citation-grounding-pl
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs verification entirely in a local context using a Node.js script. It does not perform network operations or exfiltrate data, adhering to the RODO-safe and zero-cloud claims in the documentation.
- [SAFE]: The verification logic uses standard text processing techniques such as normalization, stopword filtering, and trigram-based similarity to detect hallucinations. No dangerous dynamic code execution or obfuscation was found in the script.
- [PROMPT_INJECTION]: The skill processes untrusted legal documents (ingestion point: source_text in JSON) using Bash, Read, and Grep tools, creating a surface for indirect prompt injection. Boundary markers are absent in the input format, but the risk is safe due to the mechanical nature of the script, which uses a normalization function for sanitization rather than interpreting instructions from the input.
- [SAFE]: References to external projects in the documentation are for attribution and inspiration only; no code is downloaded or executed from remote sources at runtime.
Audit Metadata