rbac-design
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides educational content and design patterns for NIST-compliant authorization models. No malicious command execution, data exfiltration, or obfuscation patterns were detected.
- [PROMPT_INJECTION]: While the skill contains phrases like 'ignore previous instructions', these are located within a defensive hardening section that instructs the agent to ignore such commands if found in user-supplied data. This is a security best practice, not an injection attempt.
- [DATA_EXFILTRATION]: The skill uses local file-reading tools ('Read', 'Grep', 'Glob') to analyze architecture artifacts. It does not perform network operations or access sensitive system credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data (authorization policies and role metadata). It correctly identifies this attack surface and implements defensive instructions ('Injection Hardening') to prevent the agent from executing instructions embedded within those artifacts.
Audit Metadata