SaySigned - Agreement infrastructure for AI agents
v1.0.1Enable AI agents to register, create, send, sign, and verify legally binding e-signature agreements via API or email with automated key and config management.
⭐ 0· 502·0 current·0 all-time
byDenis K@klsv
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (e-signature service) match the instructions: REST endpoints, API keys, envelope creation, signing, and verification are exactly what an e-signature integration would need. No unrelated binaries or unrelated credential requests are present.
Instruction Scope
The SKILL.md instructs the agent to add MCP server entries, store Authorization headers (API keys) in MCP config, restart the MCP client, register agents, create/send envelopes, capture access tokens, and perform signing operations. While it requires human confirmation for config writes/restarts, it explicitly allows the agent to perform registration, envelope creation, signing, and verification autonomously. Allowing autonomous signing of legally binding documents without per-envelope explicit user consent is a high‑impact action and is out of scope for most benign automations.
Install Mechanism
Instruction-only skill with no install steps or code files; nothing will be written to disk by an installer. This is the lowest-risk install mechanism.
Credentials
The skill requests no environment variables and uses an in‑flow API key model (keys returned by register and then stored in MCP config). That is proportionate to an API integration, but storing long‑lived API credentials in agent config is sensitive and should be restricted/approved by the user. The skill also instructs saving per-recipient access tokens which are sensitive and must be protected.
Persistence & Privilege
The skill does not request always:true and is not force-included. However, it instructs the agent to modify the MCP client configuration and restart the MCP client (with explicit human confirmation required by the SKILL.md). Persisting an API key in the agent's global config gives long-term ability to act on behalf of the key-holder, so this persistence requires careful user control.
What to consider before installing
This skill appears to be a real e-signature integration, but it deserves careful handling. Before installing or enabling it: (1) Verify the service domain (saysigned.com) and company legitimacy independently. (2) Prefer to perform registration and paste the API key yourself rather than letting the agent write it into global MCP config; if you must store a key, create a limited-scope key and rotate it regularly. (3) Disable autonomous signing unless you explicitly want the agent to sign agreements on your behalf — require per-envelope human approval for any signature. (4) Do not allow the agent to restart system services or modify configs without an explicit confirmation dialog that the user sees and approves. (5) Be cautious about webhooks/URLs you provide (they may receive sensitive document events). If you want a safer setup, keep the key out of global configs and require manual confirmation for every sign/send action.Like a lobster shell, security has layers — review code before you run it.
ai-agentsvk97e4zrp1k3rkerfaqbnwr568d81hg15apivk97e4zrp1k3rkerfaqbnwr568d81hg15contractsvk97e4zrp1k3rkerfaqbnwr568d81hg15e-signaturesvk97e4zrp1k3rkerfaqbnwr568d81hg15esignvk97e4zrp1k3rkerfaqbnwr568d81hg15latestvk97e4zrp1k3rkerfaqbnwr568d81hg15legalvk97e4zrp1k3rkerfaqbnwr568d81hg15mcpvk97e4zrp1k3rkerfaqbnwr568d81hg15
License
MIT-0
Free to use, modify, and redistribute. No attribution required.