government-compliance
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted codebase data during the auditing process.
- Ingestion points: Codebase files and directory structures specified as the target in SKILL.md.
- Boundary markers: Absent. No explicit delimiters or instructions are used to separate the external audited data from the agent's internal logic.
- Capability inventory: The skill is restricted to data analysis and structured report generation. It lacks capabilities for shell execution, remote network operations, or privileged file modifications.
- Sanitization: Absent. Codebase content is analyzed directly for compliance gap assessment.
- [NO_CODE]: This skill consists entirely of markdown instructions and YAML metadata without any accompanying scripts, binaries, or executable code.
Audit Metadata