real-estate-compliance-rera-guardian
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data including identity documents (Emirates IDs, passports, visas) and financial records (bank statements, salary certificates, investment portfolios) for compliance auditing.
- Ingestion points: The instructions in
SKILL.mdexplicitly direct the agent to verify and collect identity documents, source of funds documentation, and marketing copy from external sources. - Boundary markers: The skill instructions do not define specific delimiters or "ignore embedded instructions" markers for the high-sensitivity data it processes.
- Capability inventory: The skill uses a wrapper script
scripts/run.shto execute a Python-based skill runner. The instructions authorize the agent to perform audits, file reports, and verify transaction details. - Sanitization: No explicit content sanitization, validation, or filtering mechanisms are described for the external documents processed by the agent.
Audit Metadata