Is skills/contract-and-proposal-writer safe?
The contract-and-proposal-writer skill is a clean, well-structured document generation assistant with no malicious indicators. The SKILL.md contains only legitimate legal document templates and jurisdiction guidance; there are no prompt injection attempts, no executable code, no exfiltration vectors, and no suspicious install-time behavior. All canary files remain intact and observed file accesses are attributable to the Oathe audit pipeline's own baseline and integrity checks rather than anything in the skill.
Category Scores
Findings (4)
INFO Collects sensitive business information by design -10 ▶
The skill's workflow explicitly asks for party legal names, business addresses, contract values, IP ownership terms, and jurisdiction details. This is appropriate and necessary for the stated purpose, but deployments should ensure conversation logs containing this data are protected according to applicable data handling policies.
INFO Bash code blocks present as user documentation -4 ▶
SKILL.md contains pandoc conversion commands in bash code fences. These are labeled as instructions for the human user to run locally after the agent generates a Markdown document. They do not instruct the agent to execute shell commands and contain no malicious flags or remote code execution patterns.
INFO Standard shallow GitHub clone with no anomalies -10 ▶
Install performed a shallow depth-1 clone of the monorepo from github.com, executed sparse checkout to extract only the target subpath, copied files, and cleaned up the temp clone. All observed behavior matches the documented Oathe install procedure.
LOW No sanitization of user-supplied contract party names in templates -4 ▶
The skill instructs the agent to fill [BRACKETED] placeholders with user-provided party names and scope descriptions. If a user (or attacker with input access) injects prompt injection strings into these fields, the generated document could contain adversarial text. Risk is limited because the output is a Markdown document, not re-injected into the agent context.