gdpr-data-handling

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: Detailed analysis of the skill instructions and the referenced implementation playbook confirms that the content is exclusively educational reference material. The skill focuses on privacy-by-design principles, consent management, and breach notification without exhibiting malicious patterns, obfuscation, or unauthorized data exfiltration.
  • [INDIRECT_PROMPT_INJECTION]: The implementation patterns in resources/implementation-playbook.md (specifically the DSARHandler and DataMinimization examples) describe systems that ingest and process external user data.
  • Ingestion points: Data is ingested through request detail objects in the submit_request method and form data in the collect_only_needed method.
  • Boundary markers: The skill does not define specific prompt boundary markers, as these are provided as implementation templates for developers rather than direct agent instructions.
  • Capability inventory: The patterns utilize database writes, event bus notifications, and local file reads for IP-to-country geolocation mapping.
  • Sanitization: The skill explicitly recommends and provides code for sanitization and mitigation, including PII hashing, data minimization through field filtering, and the use of rotating pseudonyms.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 09:09 PM