privacy-policy
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes untrusted data from a target website's source code, footer, and forms, creating a surface for indirect prompt injection.
- Ingestion points: Website source code, footer text, form fields, and data from companion skills like
data-flow-mappingandcookie-and-storage-audit. - Boundary markers: Employs a structured fact sheet with evidence labels (e.g., OBSERVED, DECLARED) and uses explicit placeholders like
[[OWNER TO PROVIDE: ...]]to clearly separate documented facts from missing data. - Capability inventory: Possesses file-writing capabilities to create or update privacy policy pages and site navigation elements.
- Sanitization: Focuses on factual verification and refuses to generate hypothetical content, providing a logical barrier against accidental obedience to embedded instructions.\n- [SAFE]: The skill references numerous official regulatory and standards organizations (e.g., EUR-Lex, FTC, W3C, ICO) for legal research. These references target well-known, trusted government and international domains.
Audit Metadata