uodo-grounding-pl
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to execute a local Node.js script located at../citation-grounding-pl/scripts/ground-citations.mjs. This script serves as a shared verification engine. The execution is scoped to a local directory and is necessary for the skill's mechanical grounding functionality. - [EXTERNAL_DOWNLOADS]: The skill fetches data from the official
uodo.gov.plwebsite usingWebFetchto confirm the existence and content of legal decisions. This is a trusted government domain, and the operation is consistent with the skill's primary purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes legal claims and citations which are external inputs. It mitigates the risk of processing sensitive or malicious data by recommending the use of the
let-it-beskill for PII pseudonimization. Evidence Chain: (1) Ingestion points: User-provided legal claims and fetched decision texts mentioned inSKILL.md. (2) Boundary markers: The workflow involves structured JSON inputs for the verification script. (3) Capability inventory:Bashfor command execution andWebFetchfor remote data retrieval. (4) Sanitization: Explicit instruction to uselet-it-befor privacy and safety.
Audit Metadata