contract-review
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses sensitive user data from Gmail and DocuSign. It searches for emails with contract-related attachments and fetches envelope details from DocuSign. These operations use integrated MCP connectors and are targeted to the stated purpose of legal review.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it processes untrusted documents.
- Ingestion points: Reads local files, Gmail attachments, and DocuSign documents.
- Boundary markers: The skill lacks explicit delimiters to isolate untrusted contract text from instructions.
- Capability inventory: Accesses email and signature services and can generate new DOCX files.
- Sanitization: No input validation or instruction-filtering is applied to the analyzed contract content.
Audit Metadata