The Agent Skills Directory

[SAFE]: No malicious patterns or security threats were detected during the analysis. The skill's primary purpose is legal document analysis, which it performs using local scripts and standard libraries.
[DATA_EXFILTRATION]: The skill operates entirely on local files. The documentation explicitly states that it does not send contracts or configurations to external network services, ensuring user data privacy.
[REMOTE_CODE_EXECUTION]: All logic is implemented via local scripts for OOXML processing. The skill does not perform remote downloads or execution of external code. Dependencies are restricted to reputable security-focused libraries.
[INDIRECT_PROMPT_INJECTION]: While the skill ingests untrusted Word documents, it implements defensive measures including safe XML parsing using defusedxml and path traversal guards (Zip Slip protection) to prevent the exploitation of common document-based attack vectors.
[COMMAND_EXECUTION]: Local shell execution is restricted to test suites and uses fixed, safe arguments to invoke the tool's own modules. No arbitrary user input is passed to shell commands.
[OBFUSCATION]: The code and documentation are entirely transparent, with no obfuscated content, hidden character tricks, or malicious URLs detected.

contract-copilot