privacy-dfd
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Data Processing Context: The skill is designed to analyze project resources such as source code, architecture documents, and database schemas. While these are sensitive materials, this access is necessary for its stated purpose of generating accurate privacy compliance artifacts.
- Indirect Prompt Injection Surface: The skill provides a framework for processing external data (e.g., code and RFCs) to extract privacy-relevant metadata. As with any tool that ingests external content, there is a potential area to review regarding how the agent handles untrusted data embedded in those sources.
- Ingestion points: External evidence gathered from architecture docs, RFCs, controller/API code, and database models as described in SKILL.md.
- Boundary markers: Currently absent; the skill relies on the agent's ability to distinguish instructions from data.
- Capability inventory: The skill is limited to generating documentation in Mermaid (.mmd) and Markdown (.md) formats.
- Sanitization: Not explicitly defined in the instructions; the skill expects the agent to interpret the data for classification purposes.
Audit Metadata