israeli-privacy-shield
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill includes a Python script (
scripts/compliance_checker.py) that processes user-provided data to determine legal compliance tiers. - Ingestion points: User data is passed to the script via the
--jsoncommand-line argument. - Boundary markers: The script and instructions emphasize the use of a strict JSON schema with specific key names.
- Capability inventory: The script performs local logic and threshold calculations. It does not have network access, file-writing capabilities, or dynamic execution (eval/exec) of user data.
- Sanitization: As of version 1.6.0, the script explicitly rejects unrecognized JSON keys and performs type-checking on numeric inputs (e.g.,
record_count) to prevent silent failures or logic bypasses. - [EXTERNAL_DOWNLOADS]: The skill references multiple external resources for legal verification and implementation examples.
- Trusted Sources: All external links target official government domains (
gov.il), established legal databases (nevo.co.il), or well-known professional services (IAPP, Microsoft, etc.). - Context: Links are used to provide the user with primary source material and tools for compliance.
- [DYNAMIC_EXECUTION]: The skill provides code templates for a TypeScript/React consent banner (
references/consent-banner-implementation.md). - Analysis: This code is provided as a reference for users to implement in their own applications. It includes standard integrations for analytics and error monitoring (e.g., Sentry, Clarity). The code is well-documented and follows security best practices such as dismiss-as-refusal and cross-tab synchronization.
Audit Metadata