structural-defensive-parsing
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides educational content and code snippets aimed at improving the robustness of data parsers against unstable external inputs. The provided Kotlin logic focuses on structural validation rather than positional assumptions, which is a security best practice for data integrity. The 'Verifying it' section provides standard shell commands for local code auditing that do not involve network activity or privilege escalation.
- [INDIRECT_PROMPT_INJECTION]: The skill defines logic for processing data from unstable third-party APIs, which represents an indirect prompt injection surface.
- Ingestion points: Parser logic in SKILL.md processes
RowandRunobjects derived from external API responses. - Boundary markers: The instructions advocate for structural field classification and strict null handling to prevent data leaking between fields.
- Capability inventory: No risky capabilities (network, filesystem write, or shell execution) are utilized by the parser logic itself.
- Sanitization: The skill recommends regex-based validation and specific heuristic guards to prevent misinterpreting plain text as structured data.
Audit Metadata