contract-review
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The instructions do not contain any bypass, override, or 'ignore previous instruction' patterns. The content focuses entirely on providing a framework for contract analysis.
- [EXTERNAL_DOWNLOADS]: The skill references resources on GitHub (claude-office-skills/all-in-one-skills). These are vendor-owned resources and do not involve unauthorized package installations or remote code execution.
- [DATA_EXFILTRATION]: There are no patterns involving sensitive file access (e.g., .ssh, .env) or network requests to untrusted third-party domains. The skill uses standard MCP tools for document parsing.
- [COMMAND_EXECUTION]: The skill uses document extraction tools (extract_text_from_pdf, extract_text_from_docx) which are appropriate for its stated purpose. No dangerous shell commands or privilege escalation attempts were found.
- [PROMPT_INJECTION] (Indirect): The skill processes user-provided contracts, creating an attack surface for indirect prompt injection. However, it lacks high-risk capabilities like network access, which limits the potential impact. Standard guardrails for document processing apply.
Audit Metadata