Security audit

Urgent Notary Packet Builder

Security checks for vulnerabilities and agentic risk

Overview

The skill is prompt-only, but its examples push the agent beyond a readiness checklist into jurisdiction-specific notary guidance and legal-document wording tasks.

Review carefully before installing. The core checklist behavior is useful, but users should not rely on this skill to draft notarial wording, decide acceptable IDs, choose jurisdiction-specific procedures, or create official journal records; those details should be verified with the notary, receiving institution, or a qualified legal professional.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This scenario directly contradicts the skill’s stated safety boundary by claiming it will insert a jurisdiction-matching notary block template and locate nearby notaries. That can push the agent into drafting quasi-legal document content and making jurisdiction-specific operational recommendations, which may cause users to rely on inaccurate notarial language or unsuitable providers under time pressure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Listing California-compliant IDs with statutory references is jurisdiction-specific legal/compliance guidance, which conflicts with the skill’s declared boundary of not deciding requirements for the user. If the information is outdated, incomplete, or misapplied to a specific notary or platform, users may appear with unacceptable ID and miss court, banking, or estate deadlines.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This scenario gives concrete, locality-specific procedural advice, institution recommendations, timing, pricing, and document-bundling strategy for Chinese notarization services, despite the skill’s stated prohibition on requirement-specific determinations. Users may treat this as authoritative and make costly or deadline-sensitive decisions based on stale, inaccurate, or locally inapplicable guidance.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The acceptance criteria explicitly require 'Content is English only,' which is a language policy constraint. Under the policy rules, forcing a specific language without offering user choice or providing a justified locale limitation is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The line states 'English/ASCII only,' which further enforces a fixed language/locale constraint. This is a policy issue because it restricts language choice without indicating user opt-in or a legitimate documented need for the limitation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example expands the skill beyond a readiness packet into service discovery and creation of post-signing artifacts, which can cause users to rely on the skill for operational or quasi-regulated notarial tasks outside its stated scope. In a legal-document context, scope creep increases the chance of inaccurate guidance, misuse, or user decisions based on unverified outputs.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README says the skill avoids legal advice, yet the example describes inserting a jurisdiction-matching notary block and giving process guidance, which may be interpreted as legal or official-document drafting assistance. Because notarial wording is jurisdiction-dependent and errors can invalidate or delay legal filings, this mismatch is materially risky.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Locating nearby notaries and adding notary-block templates without explicit warnings or verification guidance can mislead users into trusting incomplete or jurisdictionally incorrect results. In the context of time-sensitive legal documents, bad recommendations or improper certificate text can cause rejected filings, delays, or compliance failures.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The usage scenarios introduce risky capabilities—document template insertion, jurisdiction-specific ID acceptance guidance, and sensitive journal record generation—without corresponding warnings in the skill description. This mismatch increases the chance that downstream agents or users will trust and invoke these behaviors without understanding the legal, privacy, and accuracy limitations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Generating a notary journal-entry PDF goes beyond the stated packet-preparation purpose and encourages creation of a sensitive record containing signer identity and transaction details. Even without overt exfiltration, this increases privacy and data-handling risk and may mislead users into relying on a template that does not match applicable notarial recordkeeping rules.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is generally described as a broad notary-preparation tool, but Scenario 4 switches to Chinese-only input/output and prescribes a Shanghai-specific process without indicating that the user opted into that language or that the skill is region-specific. This creates a natural-language locale policy issue because it imposes a specific language/locale context rather than offering a choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 63% confidence
Finding: SQP-3 covers natural-language policy violations such as forcing or assuming a specific language without user opt-in. While this example may simply illustrate multilingual support, the README does not explicitly state that language follows user preference or that users can choose their language/locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest sets "language": "en", which is a natural-language locale constraint. Under the policy, forcing a specific language is a violation unless the skill offers a language choice or clearly documents a justified region- or compliance-specific restriction, which is not present here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.