Security audit

fadada-document-sign

Security checks for vulnerabilities and agentic risk

Overview

This is a real e-signature workflow skill, but it handles contracts, credentials, signer data, and signing/download links with under-scoped safeguards that deserve careful review before use.

Review and preferably patch this before installing in a real account. Use a dedicated least-privilege Fadada app, store credentials in a secret manager or protected environment configuration, rotate any credential matching the README example, disable or redact verbose response logging, and treat signing/download URLs and downloaded contracts as sensitive legal documents.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill describes capabilities that require network access and environment-variable credentials, but it does not declare permissions or clearly bound those capabilities. This creates a transparency and consent gap: a host agent may invoke external API calls and use secrets without an explicit permission model, increasing the risk of unintended data transmission or over-privileged execution.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The manifest advertises a narrower feature set than the notes and changelog, while the skill description and examples imply broader lifecycle operations such as withdrawal, download, batch querying, and enterprise info retrieval. This mismatch can mislead reviewers and users about the real operational scope, reducing informed consent and weakening security review for actions that affect contracts, signer data, or enterprise metadata.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README includes credential examples that look like realistic production AppID/AppSecret/openCorpId values, but it does not clearly label them as dummy values or warn users not to paste real secrets into docs, shells, screenshots, or version control. In a skill centered on enterprise e-signing, this increases the chance of accidental secret reuse or disclosure, which could enable unauthorized access to contract workflows and sensitive documents.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The README advertises sensitive capabilities such as withdrawing signing tasks and downloading signed contracts without an explicit warning that these actions affect real business processes and may expose legally significant documents. In an agent skill, understated safety messaging can lead to accidental destructive or privacy-impacting operations by users who treat the commands as low-risk convenience actions.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrases for workflow entry include broad everyday expressions that can cause the skill to activate the download workflow unintentionally. In a signing skill, mistaken activation can expose contract metadata or initiate file retrieval actions the user did not clearly request.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation allows automatic download to a local save path without a clear warning or consent checkpoint about local file writes. That can lead to unexpected persistence of sensitive contracts on disk, overwriting files, or saving into insecure locations, especially in shared or managed environments.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow collects sensitive personal data such as names, phone numbers, emails, and enterprise contact details for transmission to a third-party e-sign provider, but it does not provide privacy notice, data-handling constraints, or minimization guidance. This increases the risk of improper collection, non-compliant processing, and user surprise about where the data is sent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill handles highly sensitive materials: contract documents, signer names, phone numbers, and potentially enterprise signing data, yet the manifest provides no privacy or data-sharing warning. Users may unknowingly send confidential documents and personal information to a third-party e-signature provider, creating legal, privacy, and compliance risk if the transfer is not clearly disclosed.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The manifest requires sensitive credentials such as FADADA_APP_ID and FADADA_APP_SECRET but gives no guidance on secure provisioning, storage, rotation, or non-disclosure. In an agent ecosystem, missing secret-handling guidance increases the chance that users will paste credentials into prompts, logs, screenshots, or other insecure channels, leading to account compromise or unauthorized API use.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script logs the full API response for template details, which may include sensitive business metadata such as template names, descriptions, participant roles, and file information. In a document-signing skill, such data can reveal internal contract structure and party information through logs, which are often more broadly accessible and retained longer than the primary application data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script logs full task creation and signing URL API responses at INFO level, and elsewhere logs signer names, task IDs, template IDs, and link responses. In an e-signature workflow, these responses can contain highly sensitive business metadata and possibly access-bearing URLs; if logs are accessible to operators, support systems, or centralized log platforms, they can leak contract details and signing access to unauthorized parties.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script actively fetches per-signer signing URLs and returns them in its output without any guardrails, masking, audience restriction, or warning that these links may grant direct access to signing sessions. In the context of contract execution, such URLs are sensitive capability links; exposing them to the wrong caller, chat transcript, downstream tool, or log sink could enable unauthorized document viewing or signature actions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script logs both the outbound request payload and full API response for a document-signing task query. Those structures contain potentially sensitive business metadata such as corporate or personal openId values, task names, initiator names, approval status, and other workflow details; if logs are exposed, retained too broadly, or sent to centralized logging, this creates an information disclosure risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code logs the full API response with `json.dumps(result, ensure_ascii=False)`, which may include sensitive business metadata such as template names, descriptions, IDs, timestamps, and other tenant-specific data. In agent/runtime environments where logs are centralized or accessible to operators, this can leak confidential information beyond the intended user-facing output.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code logs the full API response with `json.dumps(result, ensure_ascii=False)`, which can include signer names, signing times, file names, and other contract workflow metadata. In an enterprise e-sign skill, these logs may be accessible to operators, aggregators, or downstream systems, creating unnecessary disclosure of sensitive business and personal information.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The parser includes `actorSignTaskUrl` in the returned output, exposing a sensitive actionable signing link. If this output is shown to unintended users, stored in transcripts, or forwarded through other tooling, it could enable unauthorized access to a signing session or leak privileged workflow entry points.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/utils.py:337