Skills
skills/edwinhu/workflows/law-review-docx/Gen Agent Trust Hub

law-review-docx

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run() to execute several external command-line tools. scripts/build_docx.py executes pandoc for document conversion, osascript for AppleScript-based PDF rendering via Microsoft Word, and soffice (LibreOffice) as a fallback renderer. Additionally, it executes the pdftotext utility in scripts/check_widows.py and calls sibling Python scripts using uv run in scripts/build_docx.py and scripts/fix_widows.py.
  • [DATA_EXFILTRATION]: The resolve_includes function in scripts/build_docx.py implements a markdown preprocessor that reads files from arbitrary absolute paths specified via <!-- include: PATH -->. This allows for local file exposure, as any file readable by the process can be included in the final document if the input markdown is maliciously crafted.
  • [EXTERNAL_DOWNLOADS]: The script scripts/build_docx.py dynamically requests the lxml package via uv run --with lxml when executing internal helper scripts, indicating a runtime dependency on external package installation.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 06:30 AM
Security Audit — agent-trust-hub — law-review-docx