contract-review-pro
Pass
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
pandoccommand-line tool viasubprocess.runto extract plain text from contract files. This is a legitimate functional requirement for processing .docx files.\n- [COMMAND_EXECUTION]: Themermaid_renderer.pyscript executesmmdc(Mermaid CLI) to render diagrams into images. The command is invoked with controlled parameters targeting temporary or output files.\n- [SAFE]: All XML parsing is performed using thedefusedxmllibrary, which protects the environment from XML External Entity (XXE) and billion laughs attacks when processing user-provided documents.\n- [SAFE]: The skill manages document changes through a "comment-only" methodology, ensuring that the legal integrity of the original contract text is never compromised during the review process.
Audit Metadata