elide-case
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill employs dynamic execution techniques to manage dependencies and share functionality across related tools. Specifically,
scripts/check-stranded-headings.pyattempts to locate a Python interpreter containing thepymupdflibrary by searching the user's PIXI environments and$HOMEdirectory, then re-executes itself usingos.execv. Additionally,scripts/check-quotes.pyusesimportlibto dynamically load an extraction module from thewestlawskill's directory. - [COMMAND_EXECUTION]: The skill's scripts frequently use
subprocess.runto invoke system utilities for PDF and text processing, such aspdfinfo,pdftotext, andjq. The scriptscripts/fetch-opinion.shusescurlto interact with the CourtListener API and storage buckets to retrieve opinion text and PDFs. - [DYNAMIC_CONTEXT_INJECTION]:
SKILL.mdcontains dynamic context placeholders (!command) that execute shell commands when the skill is loaded. These commands are used for documentation and workspace management, such as generating a table of contents viaskill-tocand loading Typst formatting rules viatypst-rules. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted court opinions fetched from external sources (e.g., CourtListener). This ingestion surface is mitigated by a mandatory "Iron Law of Authentic Text" enforced through
scripts/check-quotes.py. This script performs a verbatim comparison between the generated excerpt and the retrieved source text, failing if any mismatch or "stitching signature" (indicating out-of-order text fragments) is detected, thereby preventing the agent from including unauthorized or malicious instructions from the source material.
Audit Metadata