skills/happy-technologies-llc/happy-platform-skills/contract-obligation-extraction/Gen Agent Trust Hub
contract-obligation-extraction
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (contract attachments) and performs write operations, creating an attack surface for indirect prompt injection.\n
- Ingestion points: Fetches contract text and attachments from ServiceNow tables (
ast_contract,sys_attachment).\n - Boundary markers: The instructions do not define specific delimiters or instructions to ignore potential commands embedded within contract text.\n
- Capability inventory: The skill can create and update legal tasks and contract records (
SN-Create-Record,SN-Update-Record,SN-Add-Work-Notes).\n - Sanitization: No explicit sanitization or validation of the extracted contractual text is mentioned before it is used to populate task descriptions or metadata.
Audit Metadata