vendor-agreement-review
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill accesses local configuration files and workspace metadata located at
~/.claude/plugins/config/claude-for-legal-zh/commercial-legal/CLAUDE.mdandmatter.mdto retrieve review guidelines and project-specific contexts. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external vendor agreements. To mitigate the risk of embedded instructions in these documents, the skill implements structured analysis workflows, requires explicit source attribution (e.g., [北大法宝]), and instructs the agent to avoid generating content without valid source data.
- [COMMAND_EXECUTION]: The skill identifies integration points with external systems via Model Context Protocol (MCP) for contract management and electronic signature platforms (such as eSign and Fadada). These operations are functionally described as requiring explicit user confirmation before execution.
Audit Metadata