kalkulatory-procesowe-pl

Pass

Audited by Gen Agent Trust Hub on Jul 14, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses the WebFetch tool to retrieve current legal parameters (interest rates, act texts) from official government domains, specifically nbp.pl and sejm.gov.pl. These are well-known and trusted sources for the intended legal use case.
  • [DATA_EXFILTRATION]: No evidence of data exfiltration was found. The skill configuration explicitly states pii-egress: none and data-residency: local. Network operations are restricted to fetching public legal reference data.
  • [PROMPT_INJECTION]: No malicious prompt injection patterns were detected. The instructions use markers like "IMPORTANT" and "CRITICAL" only to emphasize mathematical accuracy and safety protocols, such as mandatory human review.
  • [COMMAND_EXECUTION]: The skill does not contain any shell commands, subprocess spawning, or dynamic execution patterns. It mentions a script for CI maintenance (scripts/wachta-parametrow-kalkulatorow.mjs), but this is not invoked at runtime by the agent.
  • [SAFE]: The skill processes user-supplied case data (dates, amounts) to perform calculations. It mitigates indirect prompt injection risks by using a strict output template ("KARTA OBLICZENIA") and requiring mandatory human approval for all results.
  • Ingestion points: User-provided case details provided during calculation requests.
  • Boundary markers: Uses a literal draft template to encapsulate calculation logic and clearly label results as drafts.
  • Capability inventory: Restricted to Read and WebFetch of government APIs.
  • Sanitization: Final output is marked as "DO ZATWIERDZENIA PRZEZ CZŁOWIEKA", ensuring a human reviews the interpolation of data before use.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 14, 2026, 08:27 AM
Security Audit — agent-trust-hub — kalkulatory-procesowe-pl