Find Law Firm

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:07 AM UTC
• Version: 1.0.0

Overview

The skill’s ServiceGraph law-firm lookup purpose is coherent, but its fallback auth recipe tells agents to source a local .env.local file as shell code, which is unsafe enough to require review.

Install only if you are comfortable with ServiceGraph receiving law-firm search and enrichment requests and with paid unlocks requiring explicit user choice. Prefer the ServiceGraph MCP/OAuth path. If using REST, do not let the agent source `.env.local`; provide only `SERVICEGRAPH_API_KEY` through a safer secret mechanism or a non-executing dotenv parser.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:79

Finding

Arbitrary Command Execution Through Shell-Sourced Environment File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 79–81
Vulnerability Type: Unsafe execution of an environment file as shell code
Risk Level: High

Complete Code Snippet:

bash

( set -a; [ -f .env.local ] && . ./.env.local; set +a;
  curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
       'https://api.servicegraph.co/v1/datasets/pro_services/fields' )

Technical Analysis

The documented authentication flow sources .env.local with the shell . command. Sourcing does not merely parse environment-variable assignments: it executes the entire file as shell code in the current subshell. Consequently, command substitutions, function invocations, redirections, and arbitrary commands present in .env.local execute with the privileges of the user running the Agent.

Although the subshell limits environment changes from propagating to the parent shell, it does not prevent filesystem modification, network access, process execution, credential theft, or other side effects. The behavior exceeds the minimum privilege required to retrieve SERVICEGRAPH_API_KEY; only one configuration value needs to be read.

The bearer-token transmission at lines 80–81 is otherwise consistent with the Skill's declared ServiceGraph integration: it sends the required credential over HTTPS to the documented api.servicegraph.co endpoint. The audit found no evidence of covert exfiltration in that request.

Attack Path

1. An attacker or compromised project dependency creates or modifies .env.local in the Agent's working directory.
2. The file includes a valid-looking key assignment and attacker-controlled shell commands, for example:

   bash

   SERVICEGRAPH_API_KEY=vk_example
   malicious_command
   

3. A user invokes the Skill to search for or enrich a law firm.
4. The Agent follows the documented REST authentication recipe.
5. The shell evaluates . ./.env.local, executing `malicious_com ...[truncated 763 chars]

Remediation

View remediation

Remediation Suggestions

• Do not source .env.local or any project-controlled configuration file as shell code.
• Use a non-executing dotenv parser that reads only SERVICEGRAPH_API_KEY.
• Reject duplicate keys, malformed lines, command substitutions, shell expansions, and unexpected variables.
• Validate the extracted value against the ServiceGraph key format, including the expected vk_ prefix and a conservative character/length allowlist.
• Pass the parsed value directly to the HTTP client without using eval or constructing an executable shell command.
• Preserve the existing guidance not to place the token in the LLM context or command output.
• Restrict .env.local permissions to the owning user and ensure it is excluded from version control.
• Prefer the documented OAuth-enabled ServiceGraph MCP integration when available, because it keeps credentials inside the harness sandbox.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill instructs the harness to source .env.local in a shell command, which is a credential-access pattern because it reads local secret material during execution. Even though the text says not to place the token in LLM context, loading environment files from the workspace broadens the attack surface: a compromised or overly permissive skill/harness could access additional secrets in that file, and shell-based secret handling is easy to misuse or log accidentally.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

1. Try the call first through a shell wrapper that sources .env.local:

   bash

   ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
     curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
          'https://api.servicegraph.co/v1/datasets/pro_services/fields' )
   

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to send authenticated requests to an external third-party API, which transmits user queries and potentially sensitive procurement or target-firm data outside the local environment. While external API use is the core function of the skill, it still creates a real data-exposure boundary and uses a bearer token, so misuse, overcollection, or sending sensitive user inputs could leak information to the service operator.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

bash

   ( set -a; [ -f .env.local ] && . ./.env.local; set +a;
     curl -sS -H "Authorization: Bearer $SERVICEGRAPH_API_KEY" \
          'https://api.servicegraph.co/v1/datasets/pro_services/fields' )

2. On 401 prompt the user: