legal-legal-risk
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill evaluates legal risks based on user-provided situational descriptions and factual inputs. It employs tools for data organization (moai-officer:doc-xlsx) and workspace management (_workspace/ directory creation), creating a surface where malicious instructions embedded within user data could potentially influence tool operations or file outputs.
- Ingestion points: User-provided legal issues and fact patterns processed through the workflow defined in SKILL.md.
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings for processing external content.
- Capability inventory: The skill has the capability to write Excel files and manage directory structures as part of its reporting workflow.
- Sanitization: There is no mention of input validation or escaping mechanisms to handle potentially malicious input strings.
- [EXTERNAL_DOWNLOADS]: The skill identifies and utilizes several official Korean government websites as information sources, including the National Law Information Center (law.go.kr), Personal Information Protection Commission (pipc.go.kr), and Korea Intellectual Property Rights Information Service (kipris.or.kr). These are established and trusted repositories for legal and regulatory data.
Audit Metadata