data-privacy
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data, such as Data Subject Access Requests (DSAR) and Record of Processing Activities (ROPA) entries, which introduces a surface for indirect prompt injection.
- Ingestion points: User-provided data for privacy registers and erasure requests as described in the documentation.
- Boundary markers: None identified in the provided templates; the skill relies on the agent's natural language understanding.
- Capability inventory: The skill instructs the agent to generate documentation (PRIVACY-SPEC.md) and outlines logic for API-driven data erasure.
- Sanitization: No specific sanitization or validation steps are outlined for the content interpolated into the privacy documentation templates.
Audit Metadata