compliance-testing
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external source code and application data to verify regulatory compliance, creating a potential surface for indirect prompt injection.
- Ingestion points: Source code fixtures and application logic provided to the
qe-security-scannerandqe-test-executoragents for auditing (referenced inevals/compliance-testing.yamlandSKILL.md). - Boundary markers: The instructions do not define specific delimiters or provide guidance to the agent to ignore instructions embedded within the data being analyzed.
- Capability inventory: The skill utilizes agents for security scanning, test execution, and release gating, which involve task coordination and potentially automated decision-making based on analyzed content (
SKILL.md). - Sanitization: There is no explicit description of sanitization, filtering, or validation logic to prevent malicious content within the analyzed files from influencing agent actions.
Audit Metadata