privacy-policy
Pass
Audited by Gen Agent Trust Hub on Mar 17, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because the workflow (Step 1) directs the agent to visit external product websites to gather data. This creates a vulnerability where a malicious website could contain hidden instructions designed to manipulate the agent's behavior or output.\n
- Ingestion points: External product websites and URLs provided by the user in SKILL.md.\n
- Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between the developer's instructions and the external data it retrieves.\n
- Capability inventory: The skill's capabilities are primarily focused on generating text-based legal documentation and compliance reports.\n
- Sanitization: The skill does not include instructions for the agent to sanitize, escape, or validate the content retrieved from external websites before it is incorporated into the prompt context.\n- [NO_CODE]: This skill does not contain any executable scripts, binary files, or code-based logic; it consists entirely of descriptive markdown instructions.
Audit Metadata