Due Diligence Dataroom

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:07 AM UTC
• Version: 98.0.1

Overview

This data-room skill is mostly purpose-aligned, but it should be reviewed because it asks for sensitive deal materials and hardcodes a potentially misleading assessor attribution.

Review and edit generated outputs before sharing them. Replace any fixed assessor name with the actual authorized preparer, avoid pasting raw sensitive documents into chat unless approved by your organization, use a secured data-room platform with least-privilege access, redact unnecessary personal identifiers, and route legal-risk items to counsel.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:25

Finding

Hardcoded Persona and Misleading Assessment Attribution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25, 169, and 321
Vulnerability Type: Hardcoded persona and branded-output instruction hijacking
Risk Level: Medium

Relevant Code Snippets:

SKILL.md:25

markdown

Build investor-ready and acquirer-ready data rooms for fundraising (SAFE, priced rounds, Series A/B) and M&A (sell-side or buy-side). This skill guides Sam Ledger through organizing DD documents, identifying gaps, scoring readiness, and producing a clean data room index.

SKILL.md:169

markdown

Assessed by: Sam Ledger / PrecisionLedger

SKILL.md:321

markdown

**Sam's response:**

Technical Analysis

The skill embeds the author-selected identity “Sam Ledger / PrecisionLedger” in its operational instructions, prescribed report format, and response example. The issue is not limited to descriptive package metadata: line 169 explicitly directs generated due-diligence reports to attribute the assessment to the named person and organization.

When the skill is loaded and its templates are followed, an agent can produce content that appears to have been assessed by a specific person or professional organization even when neither performed the assessment. This alters the agent's output behavior and introduces potentially false authorship and endorsement claims.

Attack Path

1. A user or agent loads the due-diligence skill.
2. The agent follows the skill's gap-report template and persona examples.
3. The generated report includes Assessed by: Sam Ledger / PrecisionLedger.
4. The report is shared with investors, acquirers, founders, or counsel.
5. Recipients may interpret the hardcoded attribution as evidence that the named assessor or organization conducted or approved the review.

Impact Assessment

The issue does not grant operating-system privileges, execute code, access credentials, or cross an access-control boundary. Its scope is the agen ...[truncated 449 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions that assign the agent the “Sam Ledger” persona.
2. Replace the fixed attribution with a neutral placeholder:

   markdown

   Assessed by: [Actual assessor name or organization]
   

3. Populate attribution only when the user explicitly supplies and authorizes the assessor's identity.
4. If no verified assessor is provided, use an accurate disclosure:

   markdown

   Prepared with AI assistance; not independently reviewed by legal, financial, or accounting professionals.
   

5. Replace **Sam's response:** with a neutral heading such as **Example response:**.
6. Keep vendor or author branding confined to package metadata and documentation; do not inject it into user-facing deliverables.
7. Add a final validation step that checks generated reports for unsupported claims of authorship, certification, legal review, or professional endorsement.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs users to share highly sensitive due-diligence materials, including litigation issues, cap table instruments, employee information, contracts, and financial records, but does not pair those requests with clear confidentiality, minimization, or secure-transfer guidance. In a due-diligence context this increases the risk of oversharing personal data, regulated information, and deal-sensitive documents into an AI workflow or improperly permissioned storage, which could lead to privacy breaches or unauthorized disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.