Security audit

Contract Review

Security checks for vulnerabilities and agentic risk

Overview

This is a simple contract-review instruction skill with user-directed contract input and no executable code or hidden behavior.

Before using it, avoid sharing privileged, regulated, or highly confidential contract details unless your agent environment's data handling, retention, and access controls are acceptable for that material. Treat the output as a first-pass business review, not legal advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly encourages users to paste contract text or point to contract files, but provides no warning about handling sensitive, confidential, or privileged legal data. Because contracts commonly contain proprietary terms, PII, pricing, and other protected information, this omission can lead users to disclose sensitive data to the agent or its backend without understanding privacy, retention, or access risks.

Static analysis

No suspicious patterns detected.