threat-mitigation-mapping
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes threat data containing descriptions and impact scores which are potential vectors for indirect prompt injection.\n
- Ingestion points: Threat data model defined in
resources/implementation-playbook.mdand instructions inSKILL.mdto clarify goals and required inputs.\n - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat input threat data as untrusted or to ignore embedded instructions.\n
- Capability inventory: The skill is intended for analysis and reporting, providing templates for risk calculation and roadmap generation.\n
- Sanitization: The provided templates and instructions do not include logic for sanitizing or validating the content of external threat descriptions.\n- [DYNAMIC_EXECUTION]: The skill provides code templates for testing security controls that demonstrate dynamic execution patterns via function callbacks.\n
- Evidence:
Template 4: Control Effectiveness Testinginresources/implementation-playbook.mdincludes aControlTesterclass that executestest_function()provided in aControlTestobject. This pattern describes the execution of arbitrary logic passed as a callback.
Audit Metadata