gdpr-data-handling
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate and safe implementation patterns for GDPR compliance. The code snippets for JavaScript and Python are illustrative and follow standard development practices for data handling, retention, and breach notification.
- [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for ingesting and processing untrusted user data (PII, consent forms, and access requests), which represents a vulnerability surface if these data points are later interpolated into LLM prompts without sanitization.
- Ingestion points: Untrusted data enters the system through the
recordConsent,submit_request, andDataMinimizationmethods defined inSKILL.md. - Boundary markers: None are present in the illustrative code snippets, as they focus on data persistence rather than prompt construction.
- Capability inventory: The logic includes database operations (MongoDB writes), event emissions, and local file reads (e.g.,
GeoLite2-Country.mmdb). - Sanitization: Not demonstrated in the educational snippets; the skill assumes the use of standard database drivers and data minimization techniques.
Audit Metadata