weekly-legal-briefing

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external content from the web based on a source whitelist to generate legal reports. While there are filters, processing untrusted data could lead to instruction injection in the generated summaries.\n
  • Ingestion points: Web search results and external articles retrieved based on criteria in config/sources-whitelist.txt.\n
  • Boundary markers: The skill forces a _DRAFT suffix on all output files and includes a manual checklist (templates/checklist-template.md) to enforce human review.\n
  • Capability inventory: File system write access to the archive/ directory and shell execution via subprocess.run for rendering tasks found in deploy/openclaw-deploy.md.\n
  • Sanitization: Implements a domain and account whitelist to restrict ingestion to known legal and news sources.\n- [PERSISTENCE]: Deployment guides provide explicit configuration for crontab, launchd, and GitHub Actions workflows to enable scheduled execution of the skill.\n- [COMMAND_EXECUTION]: The orchestration script scripts/run_one_period.py utilizes subprocess.run to call internal rendering scripts.\n- [EXTERNAL_DOWNLOADS]: Setup instructions involve downloading standard libraries from PyPI and browser binaries for Playwright.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 01:53 PM
Security Audit — agent-trust-hub — weekly-legal-briefing