legal-compliance-check

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze user-supplied data, including service descriptions, MAU statistics, and corporate documents for compliance and ESG reporting.
  • Ingestion points: User input for service details (e.g., MAU 100k) and ESG data requests defined in SKILL.md.
  • Boundary markers: There are no specific delimiters or instructions to ignore embedded prompts within the external data provided by the user.
  • Capability inventory: The skill utilizes file system tools (Read, Glob, Grep) as specified in references/compliance-checker.md and generates structured output files in a workspace directory (_workspace/ in references/audit-report.md).
  • Sanitization: No explicit sanitization or input validation logic is documented to prevent adversarial content within the ingested documents from influencing the agent's behavior.
  • [DYNAMIC_EXECUTION]: The skill orchestrates a complex, multi-stage workflow involving several specialized agent roles (Strategic, Data Collector, Analyst, Writer) and a post-processing chain (moai-coworker, moai-writer). This architecture involves dynamic task delegation and sequential file generation in a local workspace directory, which is a standard functional pattern for this ecosystem but increases the complexity of the execution environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 04:25 PM