matematic-konstytucja-ai
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow that ingests untrusted user data (e.g., discovery calls, workshops) to generate governance documents, creating a surface for indirect prompt injection.
- Ingestion points: Discovery calls and workshops with clients (SKILL.md).
- Boundary markers: The instructions do not specify boundary markers or instructions to isolate user-provided data during document generation.
- Capability inventory: The skill has Read and Write capabilities.
- Sanitization: There is no mention of sanitizing or validating ingested data before it is included in the output documents.
- [DATA_EXFILTRATION]: The skill describes a Shadow AI Discovery process that involves scanning for sensitive file paths and credentials, specifically .env files and API keys, as part of a security audit.
- [SAFE]: The skill references methodologies and patterns from trusted organizations, including Microsoft and GitHub, for governance and audit purposes.
Audit Metadata