lov-review-doc
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation describes the installation of standard, well-known libraries (
python-docx,lxml) and the use of platform-specific tools (npx skills) for managing the skill environment. - [EXTERNAL_DOWNLOADS]: The skill references official legal databases provided by the Chinese government (e.g., flk.npc.gov.cn, court.gov.cn) as authoritative sources for legal verification, which is appropriate for its stated purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze untrusted input from external documents (contracts). It includes a multi-step 'seven-pass' review process and explicit instructions for the agent to distinguish between text facts and legal judgments, mitigating the risk of the agent being misled by instructions embedded within the processed documents.
- [DATA_EXFILTRATION]: Analysis of the provided Python scripts (
contract_docx.py,annotate_docx.py) confirms that document processing is performed locally. There are no network transmission patterns or unauthorized data access mechanisms identified in the code.
Audit Metadata