Security audit

esign-contract

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches an e-signature contract workflow, but it asks agents to persist secrets and automatically change agent tool permissions without enough user control.

Review carefully before installing. Do not paste long-lived App Secrets into chat; prefer manual credential setup with restrictive file permissions, verify ESIGN_BASE_URL is only the official production or sandbox endpoint, avoid automatic allowedTools changes, and choose explicit private output locations for contracts and signed downloads.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/signing-guide.md:7
Finding: Automatic Modification of the Agent Tool Allowlist
Content: View full analysis
/settings.json ``` ### Technical Analysis The Skill's contract-signing functionality does not require permanent modification of the host Agent's authorization policy. Updating `allowedTools` changes an access-control boundary outside the Skill's own directory and may allow later script executions without the approval normally required by the Agent platform. The change is persistent project state rather than a permission granted only for the current operation. It therefore exceeds minimum privilege: the legitimate workflow only needs individual formatting and eSign API commands to run after the user has requested them. The instruction also does not require the user to inspect or explicitly approve the exact allowlist rule before it is written. ### Attack Path 1. A user invokes the Skill for contract drafting or signing. 2. The Agent follows the pre-signing instructions and locates the Claude Code project configuration. 3. The Agent finds that the eSign script rule is absent from `allowedTools`. 4. The Agent writes a new persistent allowlist entry without presenting the exact change for approval. 5. Subsequent commands matching that rule execute with reduced or eliminated approval prompts. 6. If the permitted script, its environment, or its dependencies are later compromised, the preauthorized execution path can be abused under the ...[truncated 372 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:31
Finding: Secrets Collected Through Chat and Written Without Enforced File Permissions
Content: View full analysis
~/.config/esign-contract/.env << 'EOF' ESIGN_APP_ID=user_provided_appId ESIGN_APP_SECRET=user_provided_appSecret ESIGN_BASE_URL=https://openapi.esign.cn EOF ``` The surrounding instruction recommends that the user provide the App ID and App Secret directly in the conversation and directs the Agent to place those values into this file. ### Technical Analysis Asking users to submit an App Secret in chat exposes the credential to conversation retention, telemetry, transcripts, debugging output, and any system that processes Agent messages. Embedding the secret into a shell command can additionally expose it through command logging, process auditing, or tool-call records. The file creation command does not set a restrictive `umask` and does not explicitly apply mode `0600`. The resulting permissions depend on the user's environment. With a common `022` umask, a newly created file may be readable by other local users. The fixed credential location is reasonable for the declared API integration, but conversational collection and permission-agnostic plaintext storage are not the minimum-risk means of provisioning it. ### Attack Path 1. The credential precheck detects that the configuration file or App ID is missing. 2. The Skill asks the user to paste the App ID and App Secret into the conversation. 3. The secret is retained in the chat or Agent tool-call history. 4. The Agent embeds the secret in a shell operation and writes `.env`. 5. A transcript reader, telemetry consumer, local command auditor, or another local user with file-read access retrieves the credential. 6. The exposed credential is used to authenticate to the eSign API as the victim application. ### Impact Assessment A disclosed App Secret may ...[truncated 257 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/esign_api.py:63
Finding: App Secret Can Be Sent to an Unrestricted Configurable Endpoint
Content: View full analysis
str: resp = requests.get( f"{self.base_url}/v1/oauth2/access_token", params={ "appId": self.app_id, "secret": self.app_secret, "grantType": "client_credentials", }, ) result = resp.json() if result.get("code") != 0: raise ESignAPIError(result.get("code"), result.get("message", "token request failed")) token = result["data"]["token"] expires_in = int(result["data"]["expiresIn"]) expires_at = expires_in / 1000 if expires_in > 1e12 else time.time() + expires_in _atomic_write_json( self._token_cache_path, {"token": token, "expires_at": expires_at}, ) return token ``` ### Technical Analysis `ESIGN_BASE_URL` is accepted without validating its scheme, hostname, port, user-information component, or relationship to the expected eSign domains. The token request then sends the App ID and App Secret to that endpoint as URL query parameters. Consequently, changing the environment variable or `.env` file can redirect the credentials to an attacker-controlled server. Query parameters also increase exposure because full URLs are commonly recorded by reverse proxies, gateways, monitoring systems, and server access logs. The declared functionality requires communication with the official production or sandbox eSign endpoints only. Permitting arbitrary destinations exceeds that requirement. ### Att ...[truncated 980 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/esign_api.py:394
Finding: Path Traversal in Signed-Document Downloads
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:48
Finding: Mutable Dependencies Installed Automatically Without Integrity Verification
Content: View full analysis
&& \ (test -d scripts/.venv || python3 -m venv scripts/.venv) && \ scripts/.venv/bin/pip install -q -r scripts/requirements.txt ``` ```text weasyprint>=60.0,<63.0 pydyf==0.11.0 pdfplumber>=0.10.0,<1.0 python-docx>=1.0.0,<2.0 requests>=2.31.0,<3.0 python-dotenv>=1.0.0,<2.0 pytest>=8.0.0,<9.0 ``` ### Technical Analysis The Skill automatically invokes `pip` during first use. Most direct dependencies are specified as version ranges, transitive dependencies are not locked, and no package hashes are supplied. Resolution therefore depends on package-index state at installation time and can produce different code after the Skill has been reviewed. Package installation and import can execute package-controlled code in the user's context. A compromised release, package-index compromise, malicious configured index, or dependency substitution can therefore alter the effective Skill payload. `pytest` is a development and testing dependency but is installed in the runtime environment, unnecessarily increasing the dependency surface. ### Attack Path 1. A user invokes the Skill for the first time. 2. The initialization command creates a virtual environment and invokes `pip`. 3. `pip` resolves mutable direct and transitive package versions from the configured package index. 4. A compromised package release, dependency, mirror, or configured index supplies malicious installation or runtime code. 5. The code executes during installation or when imported by the Skill. 6. It gains the same local file, network, and environment access as the Agent process, potentially including access to the eSign credential file. ### Impact Assessment A malicious dependency can execute arbitrary Python code with the privileges o ...[truncated 287 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (44)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description partially matches the code's e-signature workflow features: uploading files, creating signing flows, retrieving signing URLs, querying flow status, revoking flows, downloading signed documents, and verifying signatures are all implemented. However, a major declared purpose is missing from the code: there is no functionality to generate, draft, or write contracts/agreements, nor to typeset them into PDF. The code only operates on existing files and e签宝 signing APIs. Additionally, it contains some undeclared but related support capabilities such as keyword search for placement, seal position calculation, and local flow-history persistence. Because the declared description prominently claims document-generation and PDF-formatting abilities that the supplied code does not implement, this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description claims an e签宝 electronic-signature skill centered on contract generation and e-sign workflow operations. The code does none of those things. Instead, it parses local PDF/Word files to extract text and, for PDFs, coordinates of words on the last page for layout analysis. While layout extraction could be a supporting component for locating signature areas, this chunk by itself has a materially different primary purpose and exposes an undeclared capability: document content extraction. There is no evidence of e签宝 API interaction, contract drafting, PDF composition, signing initiation, progress tracking, revocation, download, or signature validation. Therefore the declared description does not accurately represent the actual behavior of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description presents a full e-signature skill centered on e签宝 workflow operations plus AI contract generation. The actual code chunk implements only one narrow sub-function: taking Markdown contract content and formatting/rendering it into a PDF. While PDF formatting is mentioned in the description, the dominant declared capabilities—electronic signing initiation and management, platform interaction, and contract generation—are absent from this code. Therefore the code materially underdelivers relative to the declared purpose and represents a different primary behavior for this chunk.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill combines two high-risk behaviors: collecting credentials through chat and persisting them to a local configuration file. In the context of an agent with shell and file-write capability, this creates a durable secret-exposure path that can survive the session and be harvested later by other processes, users, or compromised tools.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The skill references a plaintext .env file containing application credentials and provides a command sequence that writes secrets there. This is a credential-access risk because plaintext secret files are common targets for exfiltration, accidental disclosure, backup leakage, or misuse by other local tools and sessions.
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

直接输入（推荐）：请用户在对话中提供 App ID 和 App Secret（格式如 appId;appSecret），由 Agent 用 Bash 自动写入配置文件，默认使用正式环境：
bash
mkdir -p ~/.config/esign-contract && cat > ~/.config/esign-contract/.env << 'EOF' ESIGN_APP_ID=用户提供的appId ESIGN_APP_SECRET=用户提供的appSecret ESIGN_BASE_URL=https://openapi.esign.cn

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · banner.svg (reported line 19)May include surrounding context.
text
</linearGradient> </defs>  <rect width="800" height="200" fill="url(#bg)" rx="12"/>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · banner.svg (reported line 61)May include surrounding context.
text
<path d="M29 35 L34 34 L30 30 Z" fill="#06B6D4" opacity="0.8"/> </g>  <text x="60" y="130" font-family="system-ui,-apple-system,sans-serif" font-size="38" font-weight="700" fill="#ffffff" letter-spacing="-1"> eSign Contract </text>

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/esign_api.py (reported line 32)May include surrounding context.
python
# 不再依赖 Skill 目录下的 .env，避免相对路径因安装/执行目录不确定而失效 _CONFIG_DIR = Path.home() / ".config" / "esign-contract" _CONFIG_DIR.mkdir(parents=True, exist_ok=True) load_dotenv(_CONFIG_DIR / ".env") def _atomic_write_json(path: str, data: dict):

Tainted flow: 'upload_url' from pathlib.Path.read_bytes (line 240, file read) → requests.put (network output)

High

Category: Data Flow
Confidence: 80% confidence
Finding: File contents flow to a network sink. This may indicate data exfiltration of sensitive files.
Content: Scanner excerpt · scripts/esign_api.py (reported line 243)May include surrounding context.
python
upload_url = data["fileUploadUrl"] # Step 2: PUT 文件到上传地址 resp = requests.put( upload_url, data=file_bytes, headers={

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README explicitly promotes uploading contracts, processing signer names and phone numbers, and generating external signing links via the e签宝 service, but it does not warn users that sensitive contract contents and personal data will be transmitted to a third-party platform. In a skill that handles legal documents and identity/contact data, this omission can mislead users into sharing highly sensitive information without informed consent or understanding of retention, jurisdiction, and privacy implications.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly directs use of sensitive capabilities including shell execution, file reads/writes, environment access, and network calls, but does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent will execute broad host-level actions without least-privilege controls, especially because the workflow includes credential handling, local file persistence, and package installation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs the agent to ask users to paste API credentials directly into chat and then write them to a persistent local .env file via Bash. This is dangerous because chat channels may be logged or exposed to other systems, and persistent local storage broadens the attack surface for credential theft or reuse beyond the immediate task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly asks the user to provide App ID and App Secret in-chat without any warning about privacy, logging, or safer alternatives. Encouraging transmission of secrets through conversational channels normalizes insecure behavior and materially raises the likelihood of credential exposure.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 95% confidence
Finding: The command persists sensitive credentials under the user's home directory, extending their lifetime beyond the immediate interaction. Session persistence increases risk because later sessions, unrelated tools, malware, or accidental file sharing may access the stored secrets without the user's active awareness.
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

直接输入（推荐）：请用户在对话中提供 App ID 和 App Secret（格式如 appId;appSecret），由 Agent 用 Bash 自动写入配置文件，默认使用正式环境：
bash
mkdir -p ~/.config/esign-contract && cat > ~/.config/esign-contract/.env << 'EOF' ESIGN_APP_ID=用户提供的appId ESIGN_APP_SECRET=用户提供的appSecret ESIGN_BASE_URL=https://openapi.esign.cn

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill directs the agent to create a virtual environment and install dependencies on the host at runtime. Installing packages during execution introduces supply-chain and host-integrity risk, especially if dependency versions are not pinned and verified, and it expands the skill from document processing into arbitrary code execution on the user's machine.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document mandates Chinese contract structure and language conventions throughout, including Chinese headings, Chinese legal drafting norms, and formatting requirements, but does not give the user an opt-in or alternative language choice. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless clearly justified as a region-specific tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to write full contract contents, including highly sensitive personal data such as identity numbers, contact details, and addresses, into a system temporary directory without any user-facing consent, retention notice, minimization, or cleanup requirement. In this skill's context, that is particularly risky because contracts routinely contain regulated personal data and commercially sensitive terms, and temp directories may be accessible to other local processes, persisted longer than expected, or captured in logs and backups.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guide explicitly instructs the agent to inspect and automatically modify ~/.claude/projects/.../settings.json to add tool allowlist entries. That changes user/editor configuration outside the contract-signing task boundary and can silently expand what the skill is permitted to do in future runs, creating a persistence and privilege-expansion risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill tells the agent to auto-write to the user's Claude Code settings.json when rules are missing, with no warning, consent, or review step. Silent modification of local configuration is dangerous because it bypasses user intent, can weaken security controls, and may enable broader command execution than the user expected.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The guide instructs saving structured records containing full signer names, roles, and phone numbers, but provides no data-minimization, retention, or user-consent guidance. Because contract signing inherently involves sensitive personal data, this omission increases privacy and compliance risk if records are stored unnecessarily, exposed, or retained too long.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Downloaded signed contract files are written to a local directory, defaulting to the system temporary directory, without warning the user that a local copy will persist. Contracts are often highly sensitive, so writing them to temp storage can expose them to other local users, backup processes, or later recovery from disk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill stores workflow history locally, including contract names, party names, roles, and phone numbers, in ~/.config/esign-contract/flow_history.json. This creates unnecessary persistence of sensitive personal and business data beyond the immediate signing operation, increasing exposure if the host is shared, backed up, or later compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The same history feature writes sensitive workflow details to local disk without any user-facing warning or consent flow. Because this is an agent skill handling contracts and signer identities, silent persistence materially increases privacy and confidentiality risk, especially on multi-user systems or environments with broad filesystem access.
Content: No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

Category: Data Exfiltration
Confidence: 55% confidence
Finding: Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
Content: Scanner excerpt · scripts/esign_api.py (reported line 497)May include surrounding context.
python
try: if cmd == "upload": file_path = sys.argv[2] file_id = client.upload_file(file_path) print(json.dumps({"fileId": file_id})) elif cmd == "search_keyword":

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The verify command automatically uploads a local file to the remote e-sign service when the argument looks like a filesystem path, but does not clearly disclose that network transfer will occur. A user may reasonably expect local signature checking, so this behavior can cause unintended disclosure of confidential contract contents to a third party.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.