contract-review-pro
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates a high security posture by using
defusedxmlfor all XML parsing operations inscripts/document.py,scripts/utilities.py, andscripts/ooxml/. This effectively mitigates XML External Entity (XXE) vulnerabilities when processing untrusted Word documents. - [COMMAND_EXECUTION]: The skill uses
subprocess.runto invoke external system utilities likepandocfor text extraction andmmdc(Mermaid CLI) for flowchart rendering. These commands are implemented using argument lists rather than shell strings, which prevents shell injection, and are necessary for the skill's primary functionality. - [EXTERNAL_DOWNLOADS]: The skill references standard technology platforms and tools, including GitHub repositories under the author's organization (
lovstudio/review-doc-skill) and standard package managers. No unauthorized remote code execution or suspicious external network activity was detected. - [SAFE]: The implementation includes robust error handling and validation logic in
scripts/ooxml/validation/to ensure document integrity during the unpacking and repacking of Office files.
Audit Metadata