Contract Drafter

Pass

Audited by Gen Agent Trust Hub on Apr 16, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents the installation and use of standard, well-known Node.js packages including docxtemplater, pizzip, pdf-lib, and handlebars for document generation tasks.
  • [DATA_EXPOSURE]: The skill utilizes standard file system operations (fs.readFileSync, fs.writeFileSync) to manage contract templates and generated output. These operations are scoped to the internal logic for creating and reviewing documents.
  • [PROMPT_INJECTION]: The skill exhibits an indirect ingestion surface by incorporating user-provided data into contract templates.
  • Ingestion points: Data objects such as contractData, ndaData, and serviceData in SKILL.md take user input for party names, addresses, and agreement terms.
  • Boundary markers: No specific delimiters or safety instructions are present to distinguish user input from template instructions.
  • Capability inventory: The skill possesses file system read and write capabilities (fs) to process templates and save documents.
  • Sanitization: The skill relies on the standard rendering of templating engines like Handlebars and Docxtemplater without implementing additional sanitization for user-provided strings.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 16, 2026, 02:42 AM
Security Audit — agent-trust-hub — Contract Drafter