dynamic-enterprise-agent
Pass
Audited by Gen Agent Trust Hub on Mar 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses template strings and placeholders (e.g., '{token}', '{API_KEY}') for all credentials across multiple files, preventing accidental exposure of sensitive information within the skill definition.
- [SAFE]: Implements comprehensive industry-specific security and compliance patterns in 'references/industry-patterns.md', including automated PII/PHI de-identification logic (HIPAA) and PCI-DSS tokenization strategies before data is passed to an LLM.
- [COMMAND_EXECUTION]: The skill is designed to generate production-ready Python code and platform-specific configurations (ServiceNow, Salesforce, Snowflake, etc.). While it provides robust templates with mandatory human-approval gates for irreversible actions like deletions or financial transactions, the automated generation of executable code is a high-capability function that should be monitored during deployment.
- [EXTERNAL_DOWNLOADS]: The templates and platform connectors in 'references/platform-connectors.md' interact with numerous well-known enterprise services (ServiceNow, Salesforce, Okta, Snowflake, Azure, AWS, Splunk, Epic, Veeva, Bloomberg, Shopify) via their official APIs. These interactions are documented neutrally as standard integration behavior.
- [PROMPT_INJECTION]: Since the 'enterprise-signal-listener' extracts signals from natural conversations to define agent specifications, there is an inherent surface for indirect prompt injection. The skill mitigates this risk by using structured intake YAMLs, applying industry-specific compliance overrides, and requiring human review of the final deployment package.
Audit Metadata