let-it-be
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed for offline, local-only processing. Code analysis confirms the absence of network-capable modules or external API calls. It implements a security gate (ResidualPIIError) that verifies the absence of original PII in the output before completion, preventing accidental data exposure.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to run its local Node.js processing scripts. These operations are limited to text transformation tasks and follow a documented safety tier system requiring human approval for all mutating actions.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text documents. While this represents an ingestion surface for indirect prompt injection, the skill's primary function is to redact sensitive data before it reaches external models. It provides explicit human-in-the-loop warnings and governance policies to prevent the accidental inclusion of mapping files in prompts.
- [DYNAMIC_EXECUTION]: The skill uses the native node:crypto module to perform local encryption (AES-256-GCM) of pseudonymization data. It does not employ unsafe execution methods like eval() on user-supplied content.
Audit Metadata