security-risk-analyst
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is composed of purely informational markdown files intended to guide an AI agent in risk analysis workflows. It contains no executable scripts, system commands, or network activity.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an intake process for processing untrusted external data, such as vendor assessments and vulnerability reports. While this provides an attack surface for indirect prompt injection, the skill lacks the necessary capabilities (such as automated file writes, network requests, or system command execution) to act as a vector for malicious activity.
- Ingestion points: Risk assessment intake (SKILL.md), external pentest/vulnerability reports (security_risk_analyst_scope.md), and third-party assessments (third_party_and_supply_chain_risk.md).
- Boundary markers: Not present.
- Capability inventory: None. The skill defines workflows but provides no automated tools or scripts within the package.
- Sanitization: Not present.
Audit Metadata