litigation-deadline-calendar
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the agent to execute two local Python scripts (
scripts/compute_deadlines.pyandscripts/generate_ics.py). These scripts handle the core logic of calculating dates based on jurisdiction-specific rules and formatting the calendar output. This is a standard and necessary function for the skill's purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from uploaded PDF scheduling orders. To mitigate risks of the agent following instructions embedded within these documents, the skill implements a mandatory confirmation step (Step 2) where the agent must present the extracted dates to the user for verification before any computations occur.
- [DATA_EXFILTRATION]: No malicious network activity was detected. The skill performs web searches to verify court rules and legal holidays, but these are directed toward official judicial and legal domains (e.g., coloradojudicial.gov, law.cornell.edu, adr.org). No sensitive information or environment secrets are transmitted externally.
- [CREDENTIALS_UNSAFE]: No hardcoded API keys, tokens, or private secrets were found in the scripts or instructions. The skill manages user preferences (e.g., preferred calendar application) by storing them in a
CLAUDE.mdfile within the local workspace, which is a standard persistence pattern. - [SAFE]: The Python scripts perform date calculations and file formatting without the use of dangerous functions like
eval()orexec()on external data. The file operations are limited to reading the user's PDF and writing the resulting .ics file to the workspace.
Audit Metadata