kyc-kancelaria-pl
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches data from official government and international registries, including the Polish Ministry of Justice (KRS), Ministry of Finance (VAT whitelist), United Nations, and European Commission. These downloads are restricted to well-known, trusted domains for the purpose of regulatory compliance.
- [DATA_EXFILTRATION]: Designed to prevent the exfiltration of sensitive identity data. Sanction lists are downloaded and processed locally on the user's machine, ensuring that names and identifiers of checked individuals do not leave the local environment during screening.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it processes untrusted client documents and CRBR printouts. However, it implements strong mitigations: it defines clear boundary markers (
<niezaufany_dokument>), provides explicit instructions to treat document content as data only, and utilizes a deterministic local rule engine for evaluation, minimizing the risk of model manipulation by malicious data. - [COMMAND_EXECUTION]: Utilizes local Python scripts to fetch registry data and execute screening rules. The scripts use standard libraries and do not involve suspicious execution patterns or privilege escalation.
Audit Metadata