legal-compliance-check
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze user-supplied data, including service descriptions, MAU statistics, and corporate documents for compliance and ESG reporting.
- Ingestion points: User input for service details (e.g., MAU 100k) and ESG data requests defined in SKILL.md.
- Boundary markers: There are no specific delimiters or instructions to ignore embedded prompts within the external data provided by the user.
- Capability inventory: The skill utilizes file system tools (
Read,Glob,Grep) as specified inreferences/compliance-checker.mdand generates structured output files in a workspace directory (_workspace/inreferences/audit-report.md). - Sanitization: No explicit sanitization or input validation logic is documented to prevent adversarial content within the ingested documents from influencing the agent's behavior.
- [DYNAMIC_EXECUTION]: The skill orchestrates a complex, multi-stage workflow involving several specialized agent roles (Strategic, Data Collector, Analyst, Writer) and a post-processing chain (
moai-coworker,moai-writer). This architecture involves dynamic task delegation and sequential file generation in a local workspace directory, which is a standard functional pattern for this ecosystem but increases the complexity of the execution environment.
Audit Metadata