gdpr-rails
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and provides code for loading scripts from Google's official Tag Manager domain (googletagmanager.com) to manage analytics cookies. This involves a well-known service and is documented as a standard requirement for consent management.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted data through its data export and erasure patterns.
- Ingestion points: Database records in User, Order, and Message models (specifically Message.body) are accessed in SKILL.md.
- Boundary markers: None are implemented in the provided Ruby code snippets.
- Capability inventory: The skill performs database read operations (pluck) and write operations (update!, update_all). It does not perform shell execution or external network exfiltration of this data.
- Sanitization: The UserErasureService redacts sensitive content ([redacted]), though the DsarExporter returns raw data for the intended export functionality.
- [DYNAMIC_EXECUTION]: The skill demonstrates the dynamic creation and injection of script tags in the browser to load external analytics libraries only after obtaining user consent, adhering to privacy best practices.
Audit Metadata