contract-reviewer
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted external data (contracts) which could contain hidden instructions intended to bias the analysis or bypass the agent's logic.
- Ingestion points: Processes user-provided text from pastes, files, or URLs as specified in the 'How to Use' section of SKILL.md.
- Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within the analyzed documents, increasing the risk of the agent following instructions contained in the contract rather than analyzing them.
- Capability inventory: The skill is limited to text analysis and report generation; no dangerous system capabilities, subprocess execution, or unauthorized network operations were detected.
- Sanitization: There is no evidence of input validation or filtering of contract content before processing.
Audit Metadata