The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core workflow of processing untrusted contract text.
Ingestion points: Contract text is extracted from user-provided files in scripts/contract_analyzer.py using pandoc and then processed by the agent in scripts/workflow.py.
Boundary markers: The skill does not implement explicit boundary markers or "ignore embedded instructions" warnings when presenting extracted text to the language model.
Capability inventory: The skill has extensive file system access (read/write) and the ability to execute system commands via subprocess.run as seen in scripts/contract_analyzer.py and scripts/mermaid_renderer.py.
Sanitization: There is no evidence of sanitization, filtering, or validation of the extracted contract text before it is used to influence the agent's behavior.
[COMMAND_EXECUTION]: The skill invokes external system commands to perform its duties, which represents a significant capability surface.
Evidence: scripts/contract_analyzer.py calls pandoc to convert documents to plain text, and scripts/mermaid_renderer.py invokes the Mermaid CLI (mmdc) to render business flowcharts.
Mitigation: The skill correctly uses list-based arguments for subprocess.run, which effectively prevents shell injection, and employs defusedxml to mitigate XML-related attacks (XXE).

contract-review