Security audit

Employment Contract

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated purpose, but its preferred hosted workflow may send sensitive employment details to a remote service without a clear separate consent or retention disclosure.

Install only if you are comfortable with the OpenAgreements hosted MCP receiving the employment details you enter, including names, salary, dates, and contract terms. For confidential matters, prefer the local CLI or preview-only path, pin npm/npx versions where possible, avoid running installs with administrative privileges, and treat returned download URLs as sensitive links.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: template-filling-execution.md:77
Finding: Sensitive Employment Data Is Transmitted to a Remote Service Without Explicit Transmission Consent
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: template-filling-execution.md:84
Finding: Unpinned npm Installation Allows Mutable Supply-Chain Code Execution
Content: View full analysis
Remediation: View remediation
``` 2. Publish and verify the expected package integrity hash or signed provenance for the pinned release. 3. Pin transitive dependencies through a reviewed lockfile where the installation model permits it. 4. Prefer a project-local installation over a global installation so the package is isolated and easier to remove: ```bash npm install --save-exact open-agreements@ ``` 5. Run the CLI through a restricted execution environment with only the filesystem and network access required for document generation. 6. Evaluate whether lifecycle scripts are necessary. If they are not required, document an installation mode that disables them: ```bash npm install --ignore-scripts --save-exact open-agreements@ ``` 7. Pin the package or repository revision used by `npx skills add` rather than relying on mutable default resolution. 8. Add automated dependency scanning, provenance verification, publisher-account protection, and release review to the maintenance process. 9. Update the security-model wording to distinguish between: - Operation through the hosted MCP service - Installation of network-fetched npm dependencies - Execution of the locally installed CLI 10. Advise users not to install the package with administrative privileges and provide an uninstall and cleanup procedure. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · template-filling-execution.md (reported line 58)May include surrounding context.
If Local CLI: Write values to a per-run temporary JSON file with restrictive permissions:

bash
VALUES_FILE="$(mktemp /tmp/oa-values.XXXXXX.json)" chmod 600 "$VALUES_FILE" trap 'rm -f "$VALUES_FILE"' EXIT cat > "$VALUES_FILE" << 'FIELDS'