gdpr-data-handling
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: Detailed analysis of the skill instructions and the referenced implementation playbook confirms that the content is exclusively educational reference material. The skill focuses on privacy-by-design principles, consent management, and breach notification without exhibiting malicious patterns, obfuscation, or unauthorized data exfiltration.
- [INDIRECT_PROMPT_INJECTION]: The implementation patterns in
resources/implementation-playbook.md(specifically theDSARHandlerandDataMinimizationexamples) describe systems that ingest and process external user data. - Ingestion points: Data is ingested through request detail objects in the
submit_requestmethod and form data in thecollect_only_neededmethod. - Boundary markers: The skill does not define specific prompt boundary markers, as these are provided as implementation templates for developers rather than direct agent instructions.
- Capability inventory: The patterns utilize database writes, event bus notifications, and local file reads for IP-to-country geolocation mapping.
- Sanitization: The skill explicitly recommends and provides code for sanitization and mitigation, including PII hashing, data minimization through field filtering, and the use of rotating pseudonyms.
Audit Metadata