ClawHub
Back to skill

Security audit

fadada-esign

Security checks for vulnerabilities and agentic risk

Overview

This is a FaDaDa e-signature integration that performs sensitive but expected contract upload, signing, status, and download workflows.

Install only if you intend to use FaDaDa for contract signing. Confirm the contract, signer identities, phone numbers, provider endpoint, and output paths before running send, batch, download, or cancel commands; prefer environment variables or a secure secret store for API secrets, restrict config-file permissions, and treat signing links and downloaded contracts as confidential.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)

Tainted flow: 'upload_url' from requests.post (line 148, network input) → requests.put (network output)

Medium
Category
Data Flow
Content
file_id = upload_info.data.file_id
            
            with open(file_path, 'rb') as f:
                requests.put(upload_url, data=f)
            
            return file_id
        else:
Confidence
89% confidence
Finding
The code blindly trusts an upload_url returned by an external service/SDK and immediately performs requests.put(upload_url, data=f) with the contract file contents. If server_url is misconfigured, compromised, or pointed at an attacker-controlled endpoint, this can exfiltrate sensitive contract documents to an arbitrary destination, making the skill context especially sensitive because it handles legal agreements and PII.

Tainted flow: 'upload_url' from requests.post (line 148, network input) → requests.put (network output)

Medium
Category
Data Flow
Content
file_id = result["data"]["file_id"]
            
            with open(file_path, 'rb') as f:
                requests.put(upload_url, data=f)
            
            return file_id
Confidence
92% confidence
Finding
In the requests-based path, an upload_url from a remote JSON response is used directly as the destination for uploading the local file without validation. This creates an SSRF and data-exfiltration risk: a malicious or spoofed API response can redirect uploads to attacker-controlled infrastructure and capture confidential contract files.

Tainted flow: 'upload_url' from requests.post (line 126, network input) → requests.put (network output)

Medium
Category
Data Flow
Content
# 上传文件
            with open(file_path, 'rb') as f:
                requests.put(upload_url, data=f)
            
            return file_id
        else:
Confidence
89% confidence
Finding
The code takes an upload_url returned by the remote API and immediately performs requests.put to that URL without validating the host, scheme, or trust boundary. If server_url is misconfigured, compromised, or an upstream response is manipulated, this can turn the tool into an SSRF-style outbound client that uploads contract contents to an attacker-controlled endpoint, causing sensitive document exfiltration.

Tainted flow: 'upload_url' from requests.post (line 126, network input) → requests.put (network output)

Medium
Category
Data Flow
Content
# 上传文件
            with open(file_path, 'rb') as f:
                requests.put(upload_url, data=f)
            
            print(f"文件上传成功，File ID: {file_id}")
            return file_id
Confidence
89% confidence
Finding
In the non-SDK path, the upload_url is sourced from a network response and then used directly in requests.put with the contract file stream. That allows sensitive file data to be sent to any URL provided by the upstream response, which is dangerous because this skill handles confidential contracts and signed documents.

Tainted flow: 'download_url' from requests.post (line 159, network input) → requests.get (network output)

Medium
Category
Data Flow
Content
print(f"正在下载文件: {file_name}")
        
        # 下载文件
        file_response = requests.get(download_url)
        if file_response.status_code != 200:
            raise Exception(f"下载文件失败: HTTP {file_response.status_code}")
Confidence
94% confidence
Finding
The code fetches a download URL from an API response and immediately performs requests.get(download_url) without validating the scheme, host, or destination. If server_url is misconfigured, the upstream API is compromised, or a malicious endpoint returns an attacker-controlled URL, this can trigger server-side request forgery to internal services or unintended outbound access, and the downloaded content is then written to disk.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill documents access to environment variables, local file read/write, and outbound network use, but does not declare any permissions. That creates a transparency and consent problem: an agent or user may invoke a skill expecting simple contract help while it can also access credentials, persist local state, and transmit data externally. In a document-signing context, those capabilities touch sensitive contracts and API secrets, so undeclared access materially increases risk.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The documented behavior exceeds the declared purpose by including cancellation, template-based task generation, bulk/concurrent operations, local configuration management, and callback-signature utilities. This mismatch undermines informed use and review because higher-impact functions—especially destructive or large-scale ones—may be available without being advertised up front. In an e-sign workflow, hidden cancellation or bulk-send capabilities could disrupt business processes or trigger unintended signing operations at scale.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README encourages uploading contracts, sharing signer names and phone numbers, and exposing signing links to a third-party e-sign service without warning users that sensitive documents and personal data will leave their local environment. In a contract-signing skill, that omission can lead to uninformed data disclosure, compliance issues, and accidental sharing of confidential signing URLs.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger phrases include broad, common expressions such as '发合同' and '电子签', which can match ordinary conversation and cause accidental invocation. Mis-triggering matters here because the skill can read configuration, access sensitive files, and initiate real external signing workflows. In a business setting, an accidental activation could expose contract metadata or start unintended signing actions.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger list includes broad, common phrases such as '发合同', '电子签', and '下载合同', which can match routine user requests without confirming intent to use this specific skill. In a skill that can initiate legally significant signing workflows and send notifications to counterparties, overbroad triggering can cause unintended invocation and accidental contract operations.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This section documents high-impact task-control operations such as cancel, block, finish, abolish, delete, and extension without clearly warning the agent or end user that these actions may be irreversible or materially affect legal signing workflows. In an agent skill context, omission of such guardrails increases the chance that an automated assistant could execute destructive contract actions from ambiguous or insufficiently confirmed user requests.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script accepts the API secret directly as a command-line argument, which can expose the credential through shell history, process listings, audit logs, or job runners. In a signing/contract workflow, leakage of this secret could let an attacker generate valid API signatures and impersonate the integration toward the e-sign service.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The script prints signer-specific sign URLs to stdout, which can expose bearer-style access links in shell history, logs, CI output, terminal recording, or shared consoles. In an e-signature context, these URLs may grant unauthorized parties direct access to signature flows or sensitive contract details, making the context especially sensitive.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The function writes downloaded contract content directly to a caller-supplied path without validation or confinement to a safe directory. In an agent setting, a malicious prompt or unsafe higher-level caller could supply sensitive filesystem targets, causing overwrites of arbitrary local files or placement of untrusted content in risky locations.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script’s documented usage requires passing the app secret as a positional command-line argument, which can expose the credential through shell history, process listings, audit logs, or job runners. In this skill context, the secret is an API credential for contract-signing operations, so exposure could let an attacker generate valid request signatures and misuse the FASC integration.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script consumes a sensitive credential and prints authentication headers containing a valid signature, timestamp, message ID, and app ID. While this does not directly print the secret itself, the emitted material may be captured in terminal logs or automation output and could be replayed or abused if accepted by downstream systems, especially because this skill is designed to perform contract-signing actions.

Session Persistence

Medium
Category
Rogue Agent
Content
**方式二：配置文件**
```bash
# 创建配置文件
mkdir -p ~/.fadada
cat > ~/.fadada/config.json << EOF
{
  "app_id": "your_app_id",
Confidence
90% confidence
Finding
The skill recommends persisting API credentials in a fixed file under ~/.fadada/config.json, creating session-like long-lived local state containing sensitive secrets. If file permissions are misconfigured, the host is shared, backups are exposed, or other tooling reads that directory, the app secret and corporate identifiers may be disclosed. For an e-signing integration, stolen credentials can enable unauthorized contract operations and access to business documents.

Static analysis

No suspicious patterns detected.