contract-gen
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local Node.js script (
scripts/generate_contract.js) to export generated contracts to.docxformat. The script utilizes the standarddocxlibrary and performs local file system operations (reading JSON input and writing DOCX output). It usesexecSynconly to determine the localnode_modulespath for dependency resolution if the library isn't found in the immediate scope, which is a common developer utility pattern and does not involve untrusted input execution. - [DATA_EXPOSURE]: No sensitive data access or exfiltration patterns were detected. The skill operates on user-provided transaction details to generate text and saves it locally.
- [PROMPT_INJECTION]: The instructions are focused on legal drafting and quality assurance. There are no attempts to bypass safety filters or override the base agent's core instructions.
- [EXTERNAL_DOWNLOADS]: No external code or unverifiable dependencies are downloaded during runtime. The DOCX generation script requires a standard library (
docx) to be present in the environment but does not attempt to fetch it from arbitrary URLs.
Audit Metadata