contract-review-skill-cuad
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The README.md file contains instructions to install a companion tool using
pip install git+https://github.com/evolsb/legal-redline-tools.git. This involves downloading and executing code from a remote GitHub repository belonging to the author. - [PROMPT_INJECTION]: The skill is designed to analyze external documents provided by the user (contracts), which represents an attack surface for indirect prompt injection. Ingestion points: User-uploaded PDF/DOCX or pasted text (SKILL.md). Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands in the processed document. Capability inventory: Text analysis and report generation via markdown. Sanitization: No specific filtering or escaping of contract content is performed before processing.
Audit Metadata