Security audit

Document Signature Packet Builder

Security checks for vulnerabilities and agentic risk

Overview

This is a prompt-only document checklist skill with no code, network access, credentials, or persistence, though users should be careful with its example about storing sensitive scans in cloud storage.

Safe to install as a checklist helper, but do not provide full ID numbers, bank details, or sensitive document contents unless truly needed. If following its storage example, use only approved secure storage, strong account protection, limited sharing, and minimal retention for identity and financial scans.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill's operating rules say to respect privacy and avoid unnecessary collection of sensitive content, but Scenario 4 encourages centralized cloud storage of scans of IDs, bank-related records, and other sensitive paperwork. This contradiction is dangerous because it normalizes risky handling of personal documents and may cause users to rely on insecure storage practices under the authority of the skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Scenario 4 goes beyond a neutral signing checklist and actively recommends storing scans of identity, financial, and other sensitive documents in a cloud folder. That creates a real privacy and security risk because users may upload highly sensitive materials without guidance on encryption, access control, retention, or provider trust, increasing exposure from account compromise or oversharing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: These lines switch to Chinese content and provide a full scenario/output in that language, but the skill does not state that it is region-specific or that users may choose their preferred language. Under the policy, forcing or assuming a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The example explicitly advises storing scans of identity and financial documents in a cloud folder and names consumer cloud providers, but gives no warning about encryption, sharing settings, account compromise, or retention. In the context of a document-signing assistant, that materially increases the chance that users expose sensitive records beyond what is necessary for packet assembly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The example scenario is presented entirely in Chinese, including both the user request and assistant response, with no indication that language is optional or user-selected. This can be read as prescribing a specific language/locale behavior without opt-in, which falls under the policy check for language or locale constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest sets "language": "en", which indicates an English-only locale choice. Under the policy, forcing a specific language is a violation unless the skill offers user choice or clearly documents a justified locale constraint, neither of which appears here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.