Contract Drafter
Pass
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the installation and use of standard, well-known Node.js packages including
docxtemplater,pizzip,pdf-lib, andhandlebarsfor document generation tasks. - [DATA_EXPOSURE]: The skill utilizes standard file system operations (
fs.readFileSync,fs.writeFileSync) to manage contract templates and generated output. These operations are scoped to the internal logic for creating and reviewing documents. - [PROMPT_INJECTION]: The skill exhibits an indirect ingestion surface by incorporating user-provided data into contract templates.
- Ingestion points: Data objects such as
contractData,ndaData, andserviceDatainSKILL.mdtake user input for party names, addresses, and agreement terms. - Boundary markers: No specific delimiters or safety instructions are present to distinguish user input from template instructions.
- Capability inventory: The skill possesses file system read and write capabilities (
fs) to process templates and save documents. - Sanitization: The skill relies on the standard rendering of templating engines like Handlebars and Docxtemplater without implementing additional sanitization for user-provided strings.
Audit Metadata