contract-and-proposal-writer
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill's primary function is to generate jurisdiction-aware business documents (contracts, proposals, NDAs) based on standard templates provided in the instructions. The tool provides legitimate business utility without hidden malicious behaviors.
- [EXTERNAL_DOWNLOADS]: The skill references
pandoc, a well-known and reputable document conversion tool. It provides standard installation commands for macOS (brew install pandoc) and Linux (apt install pandoc) to facilitate document format conversion by the user. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided data to populate document templates. While this represents a data ingestion surface, the risk is negligible as the skill only generates text and does not automate dangerous tool executions.
- Ingestion points: User-supplied values for parties, addresses, project scopes, and financial terms in
SKILL.md. - Boundary markers: Uses
[BRACKETED]placeholders to identify variable data points and indicates missing data as "REQUIRED". - Capability inventory: The skill generates text output only. It does not perform automated file system writes or network requests; it provides manual shell commands for the user to execute locally if desired.
- Sanitization: The skill uses fixed templates to constrain the output format and includes a prominent disclaimer that the output is not a substitute for legal counsel.
Audit Metadata