contract-delivery-kickoff
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/contract_kickoff.pyscript utilizes PowerShell to interface with Excel through COM objects (via the_VERIFY_BODYscript block). This functionality is intended for verifying workbook calculations. The inputs to these commands are derived from internal logic and numeric data, minimizing the risk of arbitrary command injection. - [PROMPT_INJECTION]: The skill processes external Word documents (
.docx), which introduces an indirect prompt injection attack surface. - Ingestion points: Untrusted data is ingested from contract tables and prose in
scripts/contract_kickoff.pyvia theload_documentfunction. - Boundary markers: While explicit boundary markers are not present, the skill utilizes specific keyword-based extraction (e.g., searching for budget headers) to isolate data.
- Capability inventory: The skill has capabilities for file system access (read/write) and shell command execution via PowerShell.
- Sanitization: Extracted strings are normalized and validated using regular expressions (e.g.,
parse_number) before being processed, which limits the potential for executing embedded instructions.
Audit Metadata