Security audit

Partnership Agreement Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed legal drafting aid with no code execution or persistence, but users should treat its contract language as a draft requiring lawyer review.

Install only if you want an AI drafting aid for first-pass partnership agreement language. Do not sign, send, or rely on generated terms without review by a qualified lawyer in the relevant jurisdiction, especially for ownership, liability, IP, non-compete, tax, valuation, and exit provisions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The README markets generation of "complete clause language" and "actual contractual provisions" but does not warn users that the output can materially affect legal rights and should be reviewed by qualified counsel before use. In a legal-document context, omission of this warning is especially dangerous because users may treat the generated agreement as production-ready and execute it without validating enforceability, jurisdictional fit, or business-specific risks.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation phrase "Draft a partnership agreement for [your scenario]" is broad and likely to overlap with ordinary drafting requests, which can trigger the skill unexpectedly in contexts where the user did not explicitly intend to invoke a legal-document-generation capability. Because this skill produces substantive legal language, accidental activation increases the risk of users relying on unreviewed agreement terms that may not fit their jurisdiction or facts.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This skill instructs the agent to generate complete partnership agreements with specific clause language, jurisdiction defaults, protective provisions, and tax considerations, but it does not warn users that the output is not legal advice or require review by qualified counsel. Because these documents directly allocate rights, liabilities, governance, and exit terms, a user may reasonably rely on the generated text as legally sufficient, creating material legal and financial risk if clauses are inaccurate, incomplete, or unsuitable for the jurisdiction and facts.

Static analysis

No suspicious patterns detected.