legal-contract-review
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a suite of internal Python scripts (e.g.,
abac_filter.py,self_grade.py,seed_baseline.py) using theuv runcommand. These scripts are used for logic processing, data validation, and output rendering as part of the legal analysis pipeline. - [EXTERNAL_DOWNLOADS]: The skill performs runtime verification of statutes and court cases by fetching content from official Taiwan government domains, such as
law.moj.gov.twandjudgment.judicial.gov.tw. These operations are limited to specific legal identifiers (e.g., statute PCodes or case numbers) and are used to ensure the accuracy of legal citations. - [PROMPT_INJECTION]: The skill processes untrusted contract text provided by the user and interpolates it into prompts for analysis. While this presents an indirect prompt injection surface where a malicious document could attempt to influence the LLM's output, the skill implements structured boundary markers and a deterministic multi-layer pipeline to mitigate accidental instruction obedience.
Audit Metadata