gdpr-ropa-audit
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill instructions and scripts are focused on regulatory compliance auditing. The analysis found no evidence of prompt injection, data exfiltration, or unauthorized command execution. The Python validation script operates locally and uses standard libraries.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and validate external JSON records, which creates a surface for processing untrusted data.
- Ingestion points: RoPA JSON files are read by
scripts/process.pyfor field-level validation and audit report generation. - Boundary markers: There are no explicit instructions for the agent to ignore potentially malicious content or instructions within the audited data fields.
- Capability inventory: The skill is restricted to file reading, basic data validation logic, and report generation; it lacks network access, privileged command execution, or system-level modification tools.
- Sanitization: The validation script checks for field completeness and vague terminology but does not perform sanitization of input strings for linguistic injection patterns.
Audit Metadata