contract-helper

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill interacts with a local script named registry-events.py using an operation: propose request to update creator records. This is a functional component for synchronizing data with the creator-registry sibling skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input, specifically when users paste external contract terms for review.
  • Ingestion points: User-provided text supplied to the 'review' command in SKILL.md.
  • Boundary markers: Absent; the skill does not explicitly instruct the agent to ignore embedded commands in the pasted text.
  • Capability inventory: The skill has the ability to write to the memory/ directory and execute the local registry-events.py script.
  • Sanitization: No specific content sanitization or filtering logic is described in the provided instructions.
  • [SAFE]: Data persistence is handled through authorized paths in the memory/ directory (e.g., memory/influencer/contract-helper/), which is standard for maintaining agent state across sessions.
  • [SAFE]: The skill does not perform any external network operations or download remote code; all operations are conducted using local references and user-supplied data.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 12:35 PM
Security Audit — agent-trust-hub — contract-helper