ClawHub
Back to skill

Security audit

Nda

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent NDA drafting skill, but users should handle confidential NDA data carefully and follow the safer local CLI instructions exactly.

Before installing or using this skill, decide whether it is acceptable to send NDA details to the hosted Open Agreements service. For highly sensitive NDAs, use the local CLI path, pin open-agreements@0.7.5, validate the output filename against the documented allowlist, use only approved template identifiers, and review the generated document before signing.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
template-filling-execution.md:76
Finding

Unpinned Global Installation of a Third-Party CLI

Content
View full analysis
= 20. See the [README](https://github.com/open-agreements/open-agreements#use-with-claude-code) for details. ``` ### Technical Analysis The workflow tells users or agents to install the `open-agreements` package globally without specifying a reviewed version. This causes npm to resolve the current release at installation time, meaning the code ultimately installed can differ from the version available when the Skill was audited. This instruction is inconsistent with the safer pinned command documented in `SKILL.md`, which recommends `npm install -g open-agreements@0.7.5`. A global npm installation may also execute package lifecycle scripts under the privileges of the account performing the installation. ### Attack Path 1. An attacker compromises the upstream npm package, its publisher account, or a future package release. 2. A user or agent follows the workflow and runs `npm install -g open-agreements`. 3. npm resolves and downloads the attacker-controlled release rather than the previously reviewed version. 4. Malicious package code or lifecycle scripts execute during installation. 5. The installed global command can subsequently access or modify data available to the invoking user whenever the Skill uses it. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user performing the installation. Depending on that account's permissions, ...[truncated 385 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
template-filling-execution.md:69
Finding

Unsafe Shell Command Template for User-Influenced Output Names

Content
View full analysis
-d "$VALUES_FILE" -o .docx ``` ### Technical Analysis The documented Local CLI command leaves `` and `.docx` unquoted. The executable workflow also does not place the mandatory output filename validation directly beside the command. If an agent substitutes user-controlled content into this shell command without applying the separate restrictions from `SKILL.md`, shell metacharacters in the output name or template name can be interpreted as shell syntax. Path separators may also allow the generated file to be written outside the intended directory. Although `SKILL.md` separately requires output filenames to match `^[a-zA-Z0-9_-]{1,64}\.docx$`, the linked execution workflow does not enforce or repeat that requirement at the point where the command is constructed. This creates an unsafe implementation pattern and contradicts the statement that the workflow documents the same shell-safety rules. ### Attack Path 1. The agent asks the user to provide an output filename or otherwise derives it from user-controlled input. 2. A malicious user supplies a name containing shell syntax, such as a command separator, substitution expression, redirection operator, or path traversal sequence. 3. The agent directly replaces `` in the documented command without applying the validation rule from `SKILL.md`. 4. The shell parses the inserted characters because the argument is unquoted. 5. Injected commands execute with the agent's local privileges, or the output path targets an unintended filesystem location. A similar path exists if an untrusted template identifier is substituted for `` instead of selecting an exact identifier from the discovered and approved t ...[truncated 546 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
ecution.md) documents the same rules. This section exists so a scanner reading `SKILL.md` alone can verify that the skill acknowledges shell safety.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
1. **Output filename pattern**: match `^[a-zA-Z0-9_-]{1,64}\.docx$` — alphanumeric, underscore, hyphen only, no path separators, no dots except the single `.docx` suffix. Reject anything else.
2. **No shell metacharacters** in any field value written to the temp JSON file: reject backtick, `$(`, semicolon, pipe, ampersand, and redirects.
3. **Use a per-run secure temp file** created with `mktemp /tmp/oa-values.XXXXXX.json`, then set `chmod 600` before writing values. Do not reuse a shared filename.
4. **Heredoc quoting**: when writing field values, use a quoted heredoc (`<< 'FIELDS'`) so shell variable expansion does not apply.
5. **Reject control characters** in all values (bytes `< 0x20` except tab and newline, plus `0x7F`).
6. **Clean up with a trap** so the temp file is removed even if the fill command fails.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
1. **Output filename pattern**: match `^[a-zA-Z0-9_-]{1,64}\.docx$` — alphanumeric, underscore, hyphen only, no path separators, no dots except the single `.docx` suffix. Reject anything else.
2. **No shell metacharacters** in any field value written to the temp JSON file: reject backtick, `$(`, semicolon, pipe, ampersand, and redirects.
3. **Use a per-run secure temp file** created with `mktemp /tmp/oa-values.XXXXXX.json`, then set `chmod 600` before writing values. Do not reuse a shared filename.
4. **Heredoc quoting**: when writing field values, use a quoted heredoc (`<< 'FIELDS'`) so shell variable expansion does not apply.
5. **Reject control characters** in all values (bytes `< 0x20` except tab and newline, plus `0x7F`).
6. **Clean up with a trap** so the temp file is removed even if the fill command fails.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · template-filling-execution.md (reported line 58)May include surrounding context.

If Local CLI: Write values to a per-run temporary JSON file with restrictive permissions:

bash
VALUES_FILE="$(mktemp /tmp/oa-values.XXXXXX.json)"
chmod 600 "$VALUES_FILE"
trap 'rm -f "$VALUES_FILE"' EXIT

cat > "$VALUES_FILE" << 'FIELDS'

Static analysis

No suspicious patterns detected.