contract-writing
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious code, obfuscation, or persistence mechanisms were detected. The skill's behavior is consistent with its stated purpose of improving task planning and code verification.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user requests and project configuration files (like policies and failure patterns) to generate markdown contracts. While this is a surface for indirect prompt injection, it is the primary intended function of the skill and no exploitative patterns were identified.\n
- Ingestion points: Reads user request text and project-specific files in the
.harnessed/directory.\n - Boundary markers: None explicitly defined for delimiting untrusted input.\n
- Capability inventory: Generation of verification commands (e.g.,
npm test,curl,grep) to be written to a local markdown file.\n - Sanitization: No explicit sanitization or validation of input data is described.
Audit Metadata