oss-license-strategy
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from repository manifests, lockfiles, and user interview responses to generate licensing reports and artifacts. 1. Ingestion points: SKILL.md (Step 1) instructions guide the agent to read repository manifests and lockfiles. 2. Boundary markers: No explicit delimiters or instructions are provided to the agent to treat external file content as untrusted data that should not be interpreted as instructions. 3. Capability inventory: The skill utilizes file-read access for dependency auditing across the repository and file-write access (Step 7) to generate the final LICENSE and LICENSING.md files. 4. Sanitization: No sanitization or validation logic is specified for the data extracted from manifests or user input before it is used to populate the output decision record.
Audit Metadata