Skills
Navigate
skills/chenqg618/compliance-skills/award-contract-consistency-check-free/Gen Agent Trust Hub

award-contract-consistency-check-free

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill's documentation refers to an external payment package and a configuration guide.
  • Evidence: References to @alipay/agent-payment and https://skillpay.alipay.com/buildguide.md in SKILL.md. These are resources from a well-known technology and financial service provider.
  • [REMOTE_CODE_EXECUTION]: The skill documentation suggests running a shell command to install a payment module for an optional version upgrade.
  • Evidence: npx -y @alipay/agent-payment@latest install mentioned in SKILL.md. The package is sourced from a well-known organization.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads and processes contract data provided by the user for comparison.
  • Ingestion points: Data enters through the --input argument in scripts/run.mjs (referenced in SKILL.md).
  • Boundary markers: Data is processed locally by a JavaScript engine; it is not directly interpolated into an LLM prompt as instructions.
  • Capability inventory: The local script uses fs.readFileSync and JSON.parse. It contains no network calls or logic to execute commands based on data content.
  • Sanitization: The comparison engine in scripts/engine/award-contract-consistency-check.js uses deterministic string normalization and regex-based extraction.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 11:28 AM
Security Audit — agent-trust-hub — award-contract-consistency-check-free