contract-helper
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill interacts with a local script named
registry-events.pyusing anoperation: proposerequest to update creator records. This is a functional component for synchronizing data with the creator-registry sibling skill. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input, specifically when users paste external contract terms for review.
- Ingestion points: User-provided text supplied to the 'review' command in SKILL.md.
- Boundary markers: Absent; the skill does not explicitly instruct the agent to ignore embedded commands in the pasted text.
- Capability inventory: The skill has the ability to write to the
memory/directory and execute the localregistry-events.pyscript. - Sanitization: No specific content sanitization or filtering logic is described in the provided instructions.
- [SAFE]: Data persistence is handled through authorized paths in the
memory/directory (e.g.,memory/influencer/contract-helper/), which is standard for maintaining agent state across sessions. - [SAFE]: The skill does not perform any external network operations or download remote code; all operations are conducted using local references and user-supplied data.
Audit Metadata