contracts

Pass

Audited by Gen Agent Trust Hub on Jun 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • Runtime Setup: The skill includes instructions to install the Bun runtime from its official domain (bun.sh). This is used to execute the skill's TypeScript-based processing engine and local database tools.
  • Sandbox Permission Management: The skill offers to modify the environment's settings.json file to add its data directory to the filesystem write-allowlist. This is a transparent process requiring user approval to enable the local database to persist between sessions.
  • Local Monitoring Server: A local web server is initiated on 127.0.0.1:6226 to provide a read-only interface for inspecting analysis runs, citations, and audit logs. The skill includes documentation regarding the security characteristics of this local endpoint.
  • Subprocess Execution for Document Parsing: The skill uses spawnSync to call document extraction utilities like liteparse and pdftotext. These are used to convert various file formats (PDF, DOCX) into text for analysis.
  • Data Handling Precautions: The skill incorporates specific instructions to treat contract content as untrusted input, utilizing 'treat-as-data' wrapping to protect the agent from potential indirect prompt injection during document processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 19, 2026, 05:05 PM
Security Audit — agent-trust-hub — contracts