k2f-contract
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of a companion tool using the command
npx skills add suzheng/k2f. This fetches additional functionality from the vendor's repository to handle contract packaging. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data such as deal notes, emails, and user-provided terms to generate contract blueprints.
- Ingestion points: User-supplied deal notes, emails, and commercial terms defined in SKILL.md.
- Boundary markers: The instructions mandate labeling missing information as
NEEDS USER CONFIRMATIONand using placeholders for unsupplied data. - Capability inventory: This skill focuses on blueprint generation; the actual packaging and execution logic reside in the referenced
k2fskill. - Sanitization: Implements a 'Counsel gate' that emphasizes output is not legal advice and an 'Honesty gate' to prevent the agent from fabricating legal facts or registrations.
Audit Metadata