legal-document-analyzer

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes content from external, untrusted documents provided by the user (PDF, DOCX, and TXT formats). Maliciously crafted documents could contain hidden instructions (such as white-on-white text or metadata) designed to override the agent's behavior or manipulate the legal analysis.
  • Ingestion points: parse_contract in examples/legal_document_parser.py reads data from file paths provided to the agent.
  • Boundary markers: No specific boundary markers or 'ignore' instructions are used when passing extracted text to the analysis components.
  • Capability inventory: The skill performs document parsing, regex-based keyword extraction, and report generation. It does not possess network access or arbitrary command execution capabilities.
  • Sanitization: No sanitization or filtering of the extracted text is performed before processing.
  • [EXTERNAL_DOWNLOADS]: The skill documentation in SKILL.md identifies dependencies on third-party document processing libraries including pypdf, python-docx, and textract. These are standard libraries for the stated purpose of legal document analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 10:47 PM
Security Audit — agent-trust-hub — legal-document-analyzer