contract-reviewer
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python helper script (
contract_reviewer.py) to process documents and interact with the SoMark API. This is the primary functional component of the skill. - [EXTERNAL_DOWNLOADS]: The skill communicates with official vendor API endpoints (
somark.cnandsomark.ai) to perform high-fidelity document parsing. These network operations are limited to the vendor's infrastructure and are necessary for the skill's stated purpose. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted legal documents (PDFs, images, Word files). It mitigates potential injection attacks by including explicit instructions to the AI agent to treat all parsed content strictly as data and to ignore any embedded commands or instructions within the documents.
- [CREDENTIALS_UNSAFE]: The skill correctly handles the SoMark API Key using environment variables (
SOMARK_API_KEY) and platform-standard metadata, specifically instructing users not to paste keys into the chat interface.
Audit Metadata