event-staffing-compliance
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data describing staffing arrangements, which creates a potential surface for indirect prompt injection.
- Ingestion points: User-provided descriptions of staffing scenarios and event locations in SKILL.md.
- Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the processing logic.
- Capability inventory: The skill uses the get_compliance_by_state tool to perform network-based lookups.
- Sanitization: There are no documented validation or sanitization steps for the input data before it influences the agent's behavior.
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to vendor-controlled endpoints to provide its core functionality.
- Evidence: The skill communicates with mcp.tempguru.co for compliance data and links to documentation on tempguru.co. These resources appear to be legitimate infrastructure for the skill's stated purpose.
Audit Metadata