skills/mukul975/anthropic-cybersecurity-skills/performing-access-review-and-certification/Gen Agent Trust Hub
performing-access-review-and-certification
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a collection of auditing utilities and documentation for identity access management. The included Python scripts (scripts/agent.py and scripts/process.py) perform deterministic data processing on local files provided via command-line arguments. The skill does not perform network operations, use external dependencies, or utilize dynamic code execution.- [INDIRECT_PROMPT_INJECTION]: The skill processes external data (CSV entitlement records and JSON SoD rules) to generate audit reports. While the skill lacks dangerous capabilities that could be triggered by data content, the resulting reports could be manipulated by malicious input data to mislead auditors.
- Ingestion points: scripts/agent.py and scripts/process.py read user-provided CSV and JSON files.
- Boundary markers: Data is parsed using standard structured formats (CSV/JSON), but the skill does not include specific instructions to the agent to ignore content embedded within the data fields.
- Capability inventory: The skill is limited to local file read/write and standard data processing; it contains no network or shell execution capabilities.
- Sanitization: Standard CSV and JSON parsing is used; no additional sanitization of the values within the data fields is performed.
Audit Metadata