The Agent Skills Directory

[COMMAND_EXECUTION]: The helper scripts setup.sh and contract-scan.sh use unescaped shell variables within python3 -c command blocks. For instance, setup.sh inserts user-provided business details directly into a Python script string, and contract-scan.sh does the same with the $INPUT_FILE variable. This allows for script injection if a user is tricked into entering malicious strings during setup or scanning a file with a specially crafted name containing single quotes and Python commands.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted contract text, which is a known attack surface for indirect prompt injection.
Ingestion points: Contract review prompts and the contract-scan.sh script which reads external files (SKILL.md, contract-scan.sh).
Boundary markers: The contract-scan.sh script wraps the content in --- BEGIN/END CONTRACT TEXT --- delimiters to help the agent distinguish between instructions and data.
Capability inventory: The skill has the ability to read and write files in the local workspace, and execute helper scripts like export-doc.sh (SKILL.md, export-doc.sh).
Sanitization: No sanitization or filtering is performed on the contract text before it is presented to the AI agent.
[EXTERNAL_DOWNLOADS]: The export-doc.sh and contract-scan.sh scripts suggest the installation of external dependencies like pandoc and poppler. These are well-known, legitimate tools, and the installation is handled through the user's system package managers (e.g., Homebrew or apt), which is considered a safe practice.

Legal Docs Pro