OPC Contract Manager

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:07 AM UTC
• Version: 1.1.0

Overview

This contract-management skill handles sensitive contract files, but its local file reads, archive writes, and deadline scripts are coherent with its stated purpose and are mostly disclosed.

Before installing, be comfortable with the skill storing contract documents, extracted metadata, reports, indexes, and portfolio insights in a local contracts directory. Treat its contract analysis as a first-pass business risk review, not legal advice, and review archive outputs before relying on them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared description presents a broad contract review/copilot skill with substantive legal-review features: contract analysis, risk flagging, redline generation, negotiation email drafting, deadline tracking, archive maintenance, and portfolio insights. The supplied code only implements a narrower operational component: it reads metadata.json files from a contracts directory, validates expected fields, writes an aggregated INDEX.json, and optionally computes portfolio-level insights from metadata already present. The cross-contract insights and archive/index maintenance do align with part of the description, but the major headline capabilities—contract analysis, redline suggestions, negotiation email generation, and true deadline tracking—are not implemented in this code chunk. Therefore the description materially overstates what this code actually does, making it a mismatch.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

---

## Output Rules

- All reports in markdown
- Every report starts with disclaimer

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

names = [e.get("counterparty_name", "Unknown") for e in tfc_one_sided]
            insight["detail"] = (
                f"One-sided TFC contracts (counterparty can terminate, you cannot): {', '.join(names)}. "
                f"These represent revenue that could disappear without warning. "
                f"Prioritize renegotiating these at renewal."
            )
        else:

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to read and write files and to invoke local scripts, but it declares no explicit tool scope or permission boundaries. That creates an authorization ambiguity where an agent may access or modify workspace files beyond what the user expected, especially because the skill includes archive, search, dashboard, and indexing behaviors tied to the filesystem.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The mode detection uses broad trigger phrases like 'review', 'find', 'search', 'status', or 'archive', which can be activated by ordinary conversation rather than clear user intent. In a skill that can read indexes, run scripts, and write archive files, ambiguous routing can cause unintended filesystem actions or disclosure of contract metadata when the user only wanted advice.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The archive workflow directs the agent to create directories, copy/reference documents, generate reports, and rebuild indexes without an explicit warning or consent checkpoint. This can lead to silent persistence of sensitive contract data, accidental modification of the workspace, and expansion of the local data footprint beyond what the user intended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **Why it matters**: The counterparty can change the deal unilaterally after signing.
- **Counter-position**: Require written agreement from both parties for any amendments. No unilateral modifications.

### Assignment Without Consent
- **Pattern**: Counterparty can assign the contract to any third party without your approval
- **Why it matters**: You chose to work with a specific company. Assignment could put you under a company you'd never choose to work with.
- **Counter-position**: Require written consent for assignment, except in the case of a merger or acquisition (and even then, add a termination right if the acquirer is a competitor).

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: This code auto-generates INSIGHTS.json and INSIGHTS.md when 5 or more contracts are indexed, even if the user did not pass --insights. While the script documents the behavior in the module docstring, the automatic creation of extra output files is a file-writing side effect that is not surfaced at the decision point or gated by confirmation. Users invoking a routine index update may not expect two new files to be created based solely on entry count.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The manifest describes a contract review and contract operations copilot focused on analyzing contracts, flagging risks, generating negotiation artifacts, tracking deadlines, and maintaining a contract archive. This schema additionally models downstream invoicing workflows such as billing models, milestone payment schedules, deposits, PO requirements, invoice submission methods, and dispute windows, which are not clearly justified by the stated purpose of this skill file and extend into invoice-management capability.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The description for `billing_model` states it is 'Used by opc-invoice-manager for auto-inference,' which indicates this contract-manager schema is intentionally carrying fields for another skill's functionality. That inline documentation conflicts with the notion that this file is solely for the current skill's contract-review and archive scope, showing intent-code divergence in the embedded documentation.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The README states that archiving creates and updates a local contract directory, JSON indexes, reports, and copied originals, but it does not prominently warn users that invoking the skill will write and modify files on disk. For a contract-management skill handling sensitive legal documents and metadata, this can create an informed-consent and privacy risk because users may expose confidential contract contents, counterparties, dates, and risk assessments to local storage unexpectedly.

Scope Creep

Low

• Category: Excessive Agency

Content

**The risk**: A broad non-compete doesn't just limit one client relationship — it can make it impossible for you to earn a living, since you likely operate in a specialized niche.

**What to watch for**:
- Industry-wide non-competes (not limited to named competitors)
- Duration exceeding 6-12 months
- Geographic scope beyond where you actually served
- Non-solicitation so broad it covers the counterparty's entire client base

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

**The risk**: A broad non-compete doesn't just limit one client relationship — it can make it impossible for you to earn a living, since you likely operate in a specialized niche.

**What to watch for**:
- Industry-wide non-competes (not limited to named competitors)
- Duration exceeding 6-12 months
- Geographic scope beyond where you actually served
- Non-solicitation so broad it covers the counterparty's entire client base

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

**The risk**: A broad non-compete doesn't just limit one client relationship — it can make it impossible for you to earn a living, since you likely operate in a specialized niche.

**What to watch for**:
- Industry-wide non-competes (not limited to named competitors)
- Duration exceeding 6-12 months
- Geographic scope beyond where you actually served
- Non-solicitation so broad it covers the counterparty's entire client base

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.