security-privacy-auditor
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external project-level data, architecture, and logs, which constitutes an attack surface for indirect prompt injection if the material being audited contains adversarial instructions.
- Ingestion points: The
SKILL.mdfile directs the agent to read project-level instructions, architecture, requirements, and execution logs to perform its audit tasks. - Boundary markers: There are no explicit boundary markers or instructions to treat external data as untrusted text within the provided templates or
SKILL.md. - Capability inventory: The agent is instructed to run authorized non-destructive checks, capture environment logs, and record command executions using available platform tools.
- Sanitization: The skill does not provide instructions for sanitizing, escaping, or filtering the project data before it is processed by the agent.
Audit Metadata