contract-review-pro

Pass

Audited by Gen Agent Trust Hub on Apr 25, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the pandoc command-line tool via subprocess.run to extract plain text from contract files. This is a legitimate functional requirement for processing .docx files.\n- [COMMAND_EXECUTION]: The mermaid_renderer.py script executes mmdc (Mermaid CLI) to render diagrams into images. The command is invoked with controlled parameters targeting temporary or output files.\n- [SAFE]: All XML parsing is performed using the defusedxml library, which protects the environment from XML External Entity (XXE) and billion laughs attacks when processing user-provided documents.\n- [SAFE]: The skill manages document changes through a "comment-only" methodology, ensuring that the legal integrity of the original contract text is never compromised during the review process.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 25, 2026, 05:51 PM