contract-gen

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a local Node.js script (scripts/generate_contract.js) to export generated contracts to .docx format. The script utilizes the standard docx library and performs local file system operations (reading JSON input and writing DOCX output). It uses execSync only to determine the local node_modules path for dependency resolution if the library isn't found in the immediate scope, which is a common developer utility pattern and does not involve untrusted input execution.
  • [DATA_EXPOSURE]: No sensitive data access or exfiltration patterns were detected. The skill operates on user-provided transaction details to generate text and saves it locally.
  • [PROMPT_INJECTION]: The instructions are focused on legal drafting and quality assurance. There are no attempts to bypass safety filters or override the base agent's core instructions.
  • [EXTERNAL_DOWNLOADS]: No external code or unverifiable dependencies are downloaded during runtime. The DOCX generation script requires a standard library (docx) to be present in the environment but does not attempt to fetch it from arbitrary URLs.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 07:03 PM