metronome-create-contract
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external order forms to populate API requests, presenting a surface for indirect instructions. Ingestion points: Signed order form terms extracted in Step 1 (SKILL.md). Boundary markers: Absent; the instructions do not specify delimiters to separate untrusted data from the prompt. Capability inventory: Authenticated API access to create and list contracts and retrieve invoice details (SKILL.md). Sanitization: The skill performs unit conversions for amounts and formatting for dates but lacks specific validation or sanitization for descriptive string fields.
Audit Metadata