rodo-dsar-pl
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local script (
scripts/gdpr_deadlines.py) to calculate legal deadlines according to EU Regulation 1182/71. This is a deterministic, offline execution pattern using only standard Python libraries (argparse, calendar, json, datetime). - [PROMPT_INJECTION]: The skill processes untrusted DSAR request text which creates an indirect prompt injection surface.
- Ingestion points: User-provided DSAR requests are processed within the agent context to identify rights and deadlines.
- Boundary markers: There are no explicit delimiters or specific instructions for the agent to ignore potentially malicious commands embedded in the DSAR text.
- Capability inventory: The agent has the ability to execute the local Python script (
scripts/gdpr_deadlines.py) using the Bash tool. - Sanitization: No specific sanitization or filtering of the input text is performed before it is incorporated into the response drafts. The overall risk is low because the skill explicitly requires human approval and manual execution for sensitive actions like data deletion, export, or sending communications.
Audit Metadata