finance-insurance-fit
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data from the user's "vault insurance notes," which introduces a surface for indirect prompt injection attacks. \n
- Ingestion points: The skill explicitly mentions using "user vault insurance notes" as a source for its insurance diagnosis logic (SKILL.md). \n
- Boundary markers: No explicit boundary markers or instructions to disregard potential commands within the vault notes were identified in the skill instructions. \n
- Capability inventory: The skill provides financial guidance, insurance categorization, and remodeling checklists based on input data. \n
- Sanitization: There is no evidence of data validation, escaping, or sanitization for the content pulled from the external vault notes. \n- [SAFE]: The skill references established official Korean financial portals (e.g., 'Fine', 'Insurance Damoa') and uses tools within its own vendor ecosystem (e.g., moai-accountant, moai-coworker), representing standard and expected functionality for a financial assistant.
Audit Metadata