Security audit

KeplerJAI Contract Draft

Security checks for vulnerabilities and agentic risk

Overview

This contract-drafting skill is mostly purpose-aligned, but it asks the agent to make automatic environment/login changes and has broad persistence and file-write behavior that should be reviewed before installation.

Install only in an isolated or trusted workspace. Do not let it automatically install global packages, complete login flows, use external search, or write permanent memory unless you have explicitly approved those actions. Review generated contracts and auxiliary JSON/Markdown outputs for sensitive business data, and avoid attacker-controlled template paths or output filenames.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:65
Finding: Persistent Agent Memory Can Be Poisoned with Untrusted Contract Rules
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/word-plugin-setup.md:8
Finding: Automatic Installation of Unpinned Global Packages and Plugins
Content: View full analysis
=1.1,<2 ``` ### Technical Analysis The Skill instructs the agent to install the latest available `clawhub` package globally and then install the mutable `word-docx` plugin. No exact version, integrity hash, cryptographic signature requirement, trusted registry configuration, or package provenance check is specified. Package installation commonly executes package-controlled installation scripts. A global npm installation may therefore execute registry-supplied code with all privileges available to the agent process and modify shared executable locations. The subsequently installed plugin may also execute code when loaded. The Python dependency uses a broad version range without hashes or a lockfile. This makes installation results dependent on registry state at installation time. While the audit found no evidence that the named packages are currently malicious, the workflow permits reviewed behavior to change after publication. ### Attack Path 1. The target environment does not already contain the required Word plugin or `clawhub`. 2. The Skill directs the agent to run `npm i -g clawhub` without an exact version or integrity constraint. 3. A compromised registry account, package release, dependency, or registry-routing configuration supplies altered instal ...[truncated 874 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/contract_runner.py:643
Finding: Unvalidated Output Filename Allows Writes Outside the Output Directory
Content: View full analysis
str: explicit = str(job.get("output_filename", "")).strip() if explicit and "?" not in explicit: return explicit if explicit.lower().endswith(".docx") else f"{explicit}.docx" title = str( job.get("_effective_contract_title") or job.get("contract_title") or "Strategic Cooperation Agreement" ).strip() return f"{slug_filename(title)}_draft.docx" ``` The returned value is joined directly to the output directory: ```python output_path = uniquify_output_path( output_dir / build_output_filename(normalized_job) ) note_path = output_dir / "unresolved-items.md" summary_path = output_dir / "run-summary.json" validation_path = output_dir / "validation-report.json" ``` The resulting path is later written without a containment check: ```python doc.save(str(output_path)) ``` ### Technical Analysis The fallback filename derived from the title is sanitized, but an explicit `output_filename` is returned without equivalent validation. The code does not reject absolute paths, parent-directory components, forward slashes, backslashes, or platform-specific path syntax. With `pathlib`, joining `output_dir` to an absolute filename can discard the intended base directory. Relative values containing `..` can resolve outside it. No `resolve()` and containment check is performed before `doc.save()`. The `uniquify_output_path()` function reduces overwrite risk by selecting a versioned filename when the target already exists, but it does not prevent creation of new files outside the authorized directory. ### Attack Path 1. An attacker influences the JSON job specification generated or supplied to the runner. 2. The attacker sets `output_filename` to a traversal or abs ...[truncated 1129 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README instructs the agent to automatically check for, install, and prepare login state for a Word plugin and ClawHub environment, but does not require explicit user confirmation before changing the runtime environment. In an agent setting, this can lead to unauthorized package installation, account/session manipulation, or unintended networked actions that expand the attack surface beyond simple document drafting.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill directs the agent to read workspace files, write JSON specs and outputs, inspect memory files, and potentially invoke external tooling, but it does not declare any explicit tool/permission scope. This creates an over-broad execution surface where a host agent may grant more file or environment access than is necessary, increasing the risk of unintended data exposure or unsafe writes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs the agent to persist company introductions and rules into MEMORY.md or memory/ for future reuse, but it provides no requirement to obtain explicit user consent or warn about long-term retention. Because contract drafting commonly involves sensitive corporate data, this can lead to silent retention of confidential business information beyond the immediate task.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire skill requirements document is written in Chinese and presents the operational guidance only in that language, with no indication that users may choose another language or that the locale restriction is required for a China-specific or Chinese-only workflow. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The title and all instructions are written exclusively in Chinese, beginning with '输入规则', and the drafting guidance assumes Chinese-language contract generation. There is no indication that the user may choose another language or that this is a region-specific constraint, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to use third-party search tools to gather company information and to write user-requested versions into permanent memory. This expands the data flow beyond contract drafting, creating avoidable privacy, data retention, and external disclosure risks—especially because company descriptions and contracting context may contain sensitive business information or unverified third-party data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file consistently requires outputs and filenames in Chinese, including Chinese-only artifact names like 未决事项清单.md and <模板标题>_草稿.docx, but it does not provide any user opt-in or alternative locale handling. Under the policy, forcing a specific language or locale without choice is a natural-language policy violation unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire markdown file is written in Chinese and presents the skill guidance only in that language, with no indication that users may choose another language or that the skill is intended exclusively for a Chinese-speaking or China-specific context. Under the language/locale policy, imposing a single language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document explicitly instructs the agent to automatically modify the host environment by installing global packages, checking authentication state, prompting login, and installing a plugin before performing its core task. In an agent skill context, these steps can trigger unintended system changes and authentication actions without clear user consent, increasing the risk of supply-chain exposure, privilege misuse, and surprising side effects on the user's machine.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script generates and searches for Chinese-only headings, labels, and note content throughout the document workflow, effectively forcing a single language/locale. There is no natural-language indication that this skill is region-specific or any mechanism for user opt-in to a Chinese-only output mode.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill writes contract data and derived metadata to several local files, including a draft document, markdown note, run summary, and validation report. Because contracts commonly contain sensitive party identities and business terms, this creates a clear confidentiality risk if outputs are stored in shared, synced, or weakly permissioned workspaces without prominent disclosure or minimization.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The README consistently mandates Chinese-language prompts and outputs such as 未决事项清单.md and Chinese contract fields, but does not state that the skill is region-specific or offer the user a language/locale option. This can constitute a natural-language locale policy issue because the skill appears to force a specific language by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The entire skill content, including operational instructions and outputs, is specified only in Chinese, and it names outputs such as '未决事项清单.md' without any indication that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency specification uses a broad version range for python-docx (>=1.1,<2) rather than pinning an exact version, which makes it impossible to verify from this file alone which release will actually be installed in different environments. Because this skill processes .docx templates, an XML-parsing library with historical XXE advisories increases risk if a vulnerable or regressed version is resolved, especially when handling untrusted documents.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest describes generating contract drafts from a Word template and structured business data. In addition to processing the provided spec and template, the code inspects ~/.openclaw/openclaw.json and environment variables such as OPENCLAW_AGENT_ID to discover agent identity and workspace context, which is auxiliary platform introspection rather than an obvious requirement of document drafting.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 74% confidence
Finding: The runner accepts absolute template paths and can resolve caller-controlled relative paths against multiple base directories, allowing the skill to open arbitrary local .docx files rather than a fixed approved template set. In an agent setting, this expands file-read scope beyond the stated contract-drafting purpose and could expose unrelated local documents if an attacker can influence the job spec or CLI arguments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.