k2f-legal-notice
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation includes instructions to install a dependency using
npx skills add suzheng/k2f. This resource is authored by the same vendor ('suzheng') and is a necessary component for the skill's stated purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided matter context, custodian names, and document categories to generate legal notice blueprints. While it includes instructions for human oversight ('Counsel review') and boundary markers ('VERIFY'), the ingestion of untrusted data from the user environment is a potential surface for indirect prompt injection.
Audit Metadata