contracts
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- Runtime Setup: The skill includes instructions to install the Bun runtime from its official domain (
bun.sh). This is used to execute the skill's TypeScript-based processing engine and local database tools. - Sandbox Permission Management: The skill offers to modify the environment's
settings.jsonfile to add its data directory to the filesystem write-allowlist. This is a transparent process requiring user approval to enable the local database to persist between sessions. - Local Monitoring Server: A local web server is initiated on
127.0.0.1:6226to provide a read-only interface for inspecting analysis runs, citations, and audit logs. The skill includes documentation regarding the security characteristics of this local endpoint. - Subprocess Execution for Document Parsing: The skill uses
spawnSyncto call document extraction utilities likeliteparseandpdftotext. These are used to convert various file formats (PDF, DOCX) into text for analysis. - Data Handling Precautions: The skill incorporates specific instructions to treat contract content as untrusted input, utilizing 'treat-as-data' wrapping to protect the agent from potential indirect prompt injection during document processing.
Audit Metadata