contract-template
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@accordproject/cicero-clipackage via npm. This utility is the official command-line tool for the Accord Project, a recognized open-source organization for smart legal contracts. - [COMMAND_EXECUTION]: The skill uses
code_executionto runciceroCLI commands (parse, trigger, and draft). These operations are necessary for managing the lifecycle of the contract templates generated by the agent. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to take natural language descriptions of legal terms and convert them into executable business logic and data models, creating a surface for indirect prompt injection.
- Ingestion points: The skill accepts user-supplied text describing contract types, variables, and business rules within the
SKILL.mdworkflow. - Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the guidelines provided to the agent.
- Capability inventory: The agent has access to
code_execution,file_operations, andcomputerto interact with the local environment and the Cicero CLI. - Sanitization: There is no evidence of input validation or sanitization before the user-supplied terms are interpolated into the generated smart contract files.
Audit Metadata