File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:140
Security audit
SaySigned - Agreement infrastructure for AI agents
Security checks across malware telemetry and agentic risk
Overview
SaySigned is a coherent e-signature integration, but it gives an agent legally binding signing authority and handles powerful bearer tokens with limited per-document user approval guidance.
Install only if you trust SaySigned with contract contents, recipient data, and signing workflows. Before using it, set an explicit rule that the agent must ask a human before creating, sending, declining, or signing any agreement, and treat API keys plus recipient access tokens as legal-signing credentials that should not be logged, reused, pasted into prompts, or stored longer than needed.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
66/66 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.exposed_secret_literal