Security audit

fadada-document-sign

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its e-signature purpose, but it exposes production-looking API credentials and has unsafe handling around sensitive contract links, downloads, and cancellations.

Review before installing. Rotate or verify the published Fadada credentials are not real, avoid using production credentials until fixed, restrict the API app to least privilege, and treat logs as sensitive because signing, upload, and download URLs may appear there. Require explicit human confirmation for cancellation, production signing submission, and local contract downloads.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: README.md:167
Finding: Hardcoded Fadada API Credentials Published in Documentation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/cancel_sign_task.py:179
Finding: Fail-Open Status Validation Before Signing-Task Cancellation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/download_signed_contract.py:247
Finding: Fail-Open Completion Check Before Contract Download
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/upload_file.py:70
Finding: Sensitive Signing and Pre-Signed Storage URLs Exposed Through INFO Logs
Content: View full analysis
dict: biz_content = {"fileType": file_type} logger.info(f"获取上传URL, fileType={file_type}") result = client.request("/file/get-upload-url", biz_content) logger.info(f"上传URL响应: {json.dumps(result, ensure_ascii=False)}") return result ``` File-processing responses are also logged in full: ```python logger.info(f"处理文件: fddFileUrl={fdd_file_url}") result = client.request("/file/process", biz_content) logger.info(f"文件处理响应: {json.dumps(result, ensure_ascii=False)}") ``` Signing-link responses are logged in full: ```python result = client.request(GET_SIGN_URL_ENDPOINT, biz_content) logger.info(f"签署链接响应: {json.dumps(result, ensure_ascii=False)}") return result ``` Download-link responses and the full URL are logged: ```python result = client.request(API_ENDPOINT, biz_content) logger.info(f"下载链接响应: {json.dumps(result, ensure_ascii=False)}") ``` ```python logger.info(f"开始下载文件: {url}") response = requests.get(url, stream=True, timeout=60) ``` ### Technical Analysis Upload URLs, download URLs, and signing URLs commonly contain temporary tokens or cryptographic query parameters. These URLs function as bearer capabilities: possession of the complete URL may be sufficient to exercise the associated operation without separately possessing the Fadada API secret. The code logs entire API responses and complete URLs at INFO level. INFO logs are commonly enabled in production and may be sent to centralized log platforms, ...[truncated 1398 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/upload_file.py:86
Finding: Unvalidated Server-Provided Upload URL Receives Sensitive Contract Contents
Content: View full analysis
bool: """上传文件到OSS（使用PUT方法）。 Args: upload_url: OSS上传URL file_path: 本地文件路径 Returns: 是否上传成功 """ import requests with open(file_path, 'rb') as f: response = requests.put(upload_url, data=f, timeout=60) if response.status_code != 200: logger.error(f"上传失败: HTTP {response.status_code}") return False logger.info(f"文件上传成功") return True ``` The destination is taken directly from the remote API response: ```python upload_info = get_upload_url_and_fdd(client, "doc") upload_url = upload_info.get("uploadUrl") fdd_file_url = upload_info.get("fddFileUrl") if not upload_url or not fdd_file_url: print_result(error_response("获取上传URL失败")) return logger.info(f"获取到 uploadUrl 和 fddFileUrl") logger.info(f"上传文件到OSS...") if not upload_file_to_oss(upload_url, file_path): print_result(error_response("文件上传失败")) return ``` ### Technical Analysis Uploading the selected contract is necessary for the declared signing workflow. However, the code sends the complete file to whatever URL appears in the API response without validating: - That the scheme is HTTPS. - That the hostname belongs to Fadada or an approved storage provider. - That the port is expected. - That the URL does not contain embedded credentials. - That redirects remain within an approved destination set. This creates a trust-boundary weakness. If the API response is compromised, incorrectly configured, intercepted in an upstream component, or altered by a malicious test environment, the contract can be transmitted to an unintended destinatio ...[truncated 1264 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (52)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 从提供的 init.py 文档可见，该技能脚本包实际聚焦于“发起签署”相关能力：上传文件、发起签署、查询模板、查询任务状态。与声明相比，代码没有显示支持撤回、撤销、下载合同等关键生命周期操作，因此声明明显宽于实际行为，属于描述与代码能力不一致。未发现额外越权或无关资源访问，但主要能力范围被夸大。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该代码块的单一功能是“查询签署模板详情”，资源对象是 sign-template（模板），而声明描述的是面向合同签署流程的综合技能，涵盖合同发起、流程/任务查询、撤回、下载等多个能力。两者的主要目的和操作对象均明显不同：代码既不涉及合同实例、签署流程实例或任务，也没有下载、撤回、发起等行为，仅做模板明细查询。因此这是实质性描述-行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 根据提供的代码块，唯一明确实现的主功能是“发起合同签署任务”，包括普通文档发起、模板发起、签署方标准化、可选提交任务，以及获取签署链接。虽然代码中涉及添加签署方和提交任务，但这些都属于发起流程的组成部分。声明则描述为一个覆盖完整生命周期的技能，包含查询、撤回、下载等多种操作，且触发语义也包含‘查合同’、‘查流程’、‘查任务’、‘撤回合同’、‘下载合同’等。当前代码没有对应这些能力的实现，因此描述显著夸大了该代码块的实际功能范围，构成描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个面向合同签署流程全生命周期的综合技能，但提供的代码片段仅用于“查询签署模板列表”。它访问的资源是签署模板（sign-template/get-list），而不是合同、签署流程、任务或下载/撤回相关接口。该行为与声明的核心用途 materially different，且代码没有体现声明中的主要触发意图。因此应判定为描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个覆盖电子签全生命周期的综合技能，但所给代码块只是一段上传文件并获取 fileId 的辅助脚本，属于合同发起前置步骤之一。它没有体现查询、撤回、下载等核心能力，也没有实现“发合同”本身的签署任务创建。因此代码实际行为与声明的主要用途存在明显不一致，范围远小于声明内容。虽然文件上传可作为电子签流程的支持步骤，但单独看该代码块，无法支撑“完整签署技能”的描述。
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/FASC_API_Reference.md (reported line 16)May include surrounding context.
md
## 认证流程 ### 1. 获取 Access Token **接口**: `POST /service/get-access-token`

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The script logs the full signing URL API response, which likely includes direct sign links. These links are highly sensitive because possession of a valid signing URL may allow an unauthorized party to access or complete a signature flow without additional authorization, depending on platform controls.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/utils.py (reported line 246)May include surrounding context.
python
return headers, data def get_access_token(self) -> str: """获取 Access Token（带缓存）。 Returns: 访问凭证字符串

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README advertises撤回签署/撤销签署 capability as a feature but does not warn that withdrawing a signing task can interrupt legal or business workflows, invalidate ongoing approvals, or cause data/state loss from a user perspective. In a contract-signing skill, destructive operations deserve explicit confirmation and impact disclosure because an agent may expose this action to end users who do not understand the consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README promotes downloading signed contracts without any warning that these files likely contain sensitive personal, employment, or commercial data. In the context of an e-signature skill, encouraging download flows without handling guidance increases the risk of unauthorized disclosure, insecure local storage, and accidental sharing of legally sensitive documents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The credential examples include what appear to be realistic secret values and instruct users to place them in shell startup files, which are often broadly readable, persisted, and prone to accidental disclosure via screenshots, backups, dotfile sync, or support sharing. Even if placeholders were intended, this documentation pattern normalizes insecure secret handling for a system that can initiate, cancel, and download legally sensitive signing workflows.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares broad network and environment-dependent behavior but does not define any explicit tool scope or permission boundaries. That creates an over-privileged integration surface where the agent may access credentials and perform external API actions without clear least-privilege constraints or user-visible guardrails.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases are broad everyday commands such as '查合同' and '下载合同', making accidental or context-confused activation more likely. In a skill that can upload files, query contract data, cancel signature tasks, and download documents, overbroad invocation can lead to unintended state changes or disclosure of sensitive contract information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entry constraints use ambiguous intent examples without strong scope checks, so the agent may route generic user requests into this skill even when the user did not intend to operate on the Fadada account. Because the skill can perform external actions against live signing workflows, ambiguous activation increases the risk of unauthorized or mistaken operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill allows downloading signed contracts to a local path but does not prominently warn users that files may be written to local storage. This can result in sensitive signed contracts being stored in unintended locations, exposing regulated or confidential documents to other local users, backups, or downstream tooling.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 83% confidence
Finding: The skill is explicitly designed to transmit contract files, signer information, and workflow metadata to an external third-party API endpoint. External transmission is expected in this business context, but it still creates real data exposure risk because highly sensitive documents and personal information leave the local system and are sent to a remote service.
Content: Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.
md
### API基础信息 - **API版本**: FASC API 5.0 - **正式环境**: https://api.fadada.com/api/v5 - **UAT测试环境**: https://uat-api.fadada.com/api/v5 ### 环境配置

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description and capabilities focus on upload, initiate signing, template query, and task-detail query. However, the same file's trigger-context, notes, changelog, and examples-related metadata indicate additional implemented lifecycle operations such as 撤回任务, 下载合同, 批量查询任务列表, and API-based enterprise information retrieval, which are materially broader than the declared core capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill handles highly sensitive artifacts including contracts, names, phone numbers, and signature workflow data, but the manifest provides no warning about privacy, data handling, or compliance expectations. In an enterprise e-signature context, this increases the risk of accidental exposure, improper sharing, or unsafe use of production data by operators who are not adequately warned.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON file contains user-facing strings such as the title and action labels entirely in Chinese, but there is no visible indication that the skill is limited to Chinese-speaking users or offers a language/locale choice. That can violate language/locale policy when the skill is expected to work across users without explicit opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This JSON form presents all user-facing labels and instructions only in Chinese, including the title, description, field labels, placeholders, and submit action. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the locale restriction is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This JSON result card contains multiple user-facing labels and titles exclusively in Chinese, such as the title and field/action labels. For all file types, hard-coding a specific language without opt-in or documented locale justification can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This JSON UI definition contains all user-facing text in Chinese, including the title, description, column labels, empty state, and action label. Because the file provides no indication that the skill is region-specific or that users can opt into this locale, it appears to enforce a specific language without user choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file describes obtaining upload URLs, processing documents, creating signing tasks, and sending signer notification data such as phone numbers to an external e-signature service. Under the markdown-specific SQP-2 criteria, the description should warn users that document contents and personal contact information will be transmitted to a third-party API, but no such warning appears in the documented workflow.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest says the skill covers the full e-sign lifecycle including existing process query, withdrawal/revocation, and contract download. However, this module docstring enumerates only upload, initiate signing, template list/detail, and signing status query scripts, which is a narrower capability set and does not mention withdrawal or download operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code logs the full API response and the contract download operation, which can expose sensitive signed-contract metadata and time-limited download URLs to stderr or centralized logs. In an agent/integration environment, logs are often accessible to operators, support staff, or downstream observability systems, so this can unintentionally disclose private documents or enable unauthorized retrieval while the URL remains valid.
Content: No source excerpt is available for this finding.