vendor-evaluation
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill contains process-oriented documentation, rubrics, and guidelines for procurement and vendor management. No executable scripts, command-line triggers, or active network tools are present in the analyzed files.
- [INDIRECT_PROMPT_INJECTION]: The skill involves processing external vendor-provided documentation, such as security questionnaires and SOC 2 reports, which serves as an ingestion point for untrusted data. However, the framework is designed for human-led analysis and lacks automated tool capabilities that could be exploited via injection.
- Ingestion points: Vendor security questionnaires, compliance reports, and RFP responses (SKILL.md, Step 5).
- Boundary markers: None present.
- Capability inventory: No tool invocations, shell executions, or file-write capabilities identified in the skill files.
- Sanitization: No automated sanitization logic is present as the skill is documentation-based.
Audit Metadata