pua-survey
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions involve capturing survey responses and potentially uploading them to an external location.
- Evidence: The instruction "Ask before any upload" in
SKILL.mdconfirms that the skill has a data transmission workflow. - [INDIRECT_PROMPT_INJECTION]: The skill processes responses from a survey, which represents a surface for instructions to be embedded in data that could influence the agent.
- Ingestion points: Survey responses processed in
SKILL.md. - Boundary markers: Absent; there are no delimiters or warnings to treat survey data as untrusted content.
- Capability inventory: The skill can create the
~/.pua/directory and modify~/.pua/config.json. - Sanitization: Absent; the instructions do not require any filtering or escaping of the survey responses before they are saved to the configuration file.
Audit Metadata