non-compete-contract-explainer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:25 AM UTC
• Version: 0.2.0

Overview

This is a coherent offline legal explainer; the main caution is an optional unpinned command for installing a related skill.

Installers should treat this as a legal-information skill, not a lawyer. Before relying on an answer, check the stated law-check dates and consider the optional canonical refresh. Do not run the optional npx install command for the related skill unless you deliberately want that separate package and have reviewed or pinned the install source.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:109

Finding

Unpinned Third-Party Package Installation Recommendation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 109-114
Vulnerability Type: Supply-chain exposure through an unpinned package installer
Risk Level: Medium

markdown

- When the user wants to *draft* hiring paperwork (offer letter, IP assignment,
  confidentiality) rather than understand the law, point them to the
  OpenAgreements employment skill. To avoid look-alike skills from other
  publishers, identify it by its full package path, not the bare name:
  `open-agreements/open-agreements@employment-contract`
  (install: `npx skills add open-agreements/open-agreements`).

Technical Analysis

The Skill recommends running npx skills add open-agreements/open-agreements without pinning either the skills CLI or the target package to an immutable, audited version. No package integrity hash or trusted artifact digest is supplied.

Because package registry contents and default versions can change after this Skill has been reviewed, executing the recommendation may download and run code that was not part of the audited artifact. Depending on the behavior of the package manager and installer, package installation may invoke lifecycle scripts or other executable installation logic.

This recommendation also creates tension with the statement at SKILL.md:121-122 that the Skill does not download or execute network code. Although the command is presented as a related-skill installation instruction rather than an automatic action, following it causes a network-backed package installation.

Attack Path

1. A user asks for help drafting employment paperwork rather than explaining non-compete law.
2. Following SKILL.md, the agent recommends the supplied npx installation command.
3. The user or an authorized agent runs the command.
4. npx resolves the CLI and package from mutable external package sources without an audited version or integrity constraint.
5. If the resolved CLI, target packag ...[truncated 938 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the executable installation command if the related package is not required for this Skill’s core functionality.
2. Prefer a non-executable catalog link or package identifier and require the user to review installation documentation independently.
3. If installation guidance must remain, pin both the installer CLI and target package to specific reviewed versions rather than relying on mutable defaults.
4. Supply and verify cryptographic integrity hashes or signed release attestations for all downloaded artifacts.
5. Require explicit user approval immediately before installation and clearly disclose that external code will be downloaded and may execute locally.
6. Recommend installation in an isolated, least-privileged environment without production credentials or sensitive environment variables.
7. Audit the target package, transitive dependencies, and lifecycle scripts before recommending a new release.
8. Revise the no-download/no-execution statement so it accurately distinguishes the Skill’s normal behavior from optional third-party installation guidance.

SkillSpector

Vulnerability Patterns

• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (75)

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/alaska.md (reported line 140)May include surrounding context.

md

ore%2C%20strictly%20construed.>

[^data-management-reasonableness-factors]: **Data Management, Inc. v. Greene** — "Among the factors properly to be considered are: ‘[t]he absence or presence of limitations as to time and space, * * * whether the employee represents the sole contact with the customer; whether the employee is possessed with confidential information or trade secrets; whether the covenant seeks to eliminate competition which would be unfair to the employer or merely seeks to eliminate ordinary competition; whether the covenant seeks to stifle the inherent skill and experience of the employee; whether the benefit to the employer is disproportional to the detriment to the employee; whether the covenant operates as a bar to the employee’s sole means of support; whether the employee’s talent which the employer seeks to suppress was actually developed during the period of employment; and whether the forbidden employment is merely incidental to the main employment.’" *

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/arizona.md (reported line 276)May include surrounding context.

md

legal advice from a Arizona-admitted attorney. This article is for informational purposes only and does not create an attorney-client relationship. CC BY 4.0. Cite as Steven Obiajulu, *Non-Competes in Arizona*, OpenAgreements (last updated June 3, 2026), https://openagreements.org/practice-guides/non-compete/us/arizona.

[^q1-amex-disfavored]: **Amex Distributing Co. v. Mascari** — "Restrictive covenants which tend to prevent an employee from pursuing a similar vocation after termination of employment are disfavored." *Amex Distributing Co. v. Mascari, 150 Ariz. 510, 724 P.2d 596 (Ct. App. 1986).* <https://www.courtlistener.com/opinion/1211495/amex-distributing-co-inc-v-mascari/#:~:text=Restrictive%20covenants%20which%20tend%20to,termination%20of%20employment%20are%20disfavored.>

[^q1-farber-reasonableness]: **Valley Medical Specialists v. Farber** — "A restriction is unreasonable and thus will not be enforced: (1) if the restraint is greater than necessary to protect the employer

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/arkansas.md (reported line 202)May include surrounding context.

md

individuals or entities associated with the employer's business; and (D) The nature of the employer's business." *Ark. Code Ann. § 4-75-101(c).* <https://advance.lexis.com/document/?pdmfid=1000516&pddocfullpath=/shared/document/statutes-legislation/urn:contentItem:6F8J-XPN0-R03K-P3X3-00008-00>

[^q2-mercy-no-ordinary-competition]: **Mercy Health Sys. of Nw. Ark., Inc. v. Bicak** — "Unless the covenantee has a legitimate interest to be protected by the agreement, the law will not enforce such a contract, as this would merely prohibit ordinary competition." *Mercy Health Sys. of Nw. Ark., Inc. v. Bicak, 2011 Ark. App. 341, 383 S.W.3d 869.* <https://www.courtlistener.com/opinion/5283436/mercy-health-system-of-northwest-arkansas-inc-v-bicak/#:~:text=Unless%20the%20covenantee%20has%20a,would%20merely%20prohibit%20ordinary%20competition.>

[^q3-aca-no-geography]: **Ark. Code Ann. § 4-75-101** — "The lack of a specific or defined geographic descriptive restriction in a covenant not to

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/california.md (reported line 220)May include surrounding context.

md

st-restraint rule under section 16600." *Edwards v. Arthur Andersen LLP, 44 Cal. 4th 937 (2008).* <https://www.courtlistener.com/opinion/5608069/edwards-v-arthur-andersen-llp/#:~:text=We%20reject%20Andersen's%20contention%20that,prohibition%2Dagainst%2Drestraint%20rule%20under%20section%2016600.>

[^fillpoint-void]: **Fillpoint, LLC v. Maas** — "In this case, when we read the two noncompetition covenants together, we hold that the noncompetition and nonsolicitation covenant contained in the employment agreement is void and unenforceable under California law." *Fillpoint, LLC v. Maas, 208 Cal. App. 4th 1170 (2012).* <https://www.courtlistener.com/opinion/5811287/fillpoint-llc-v-maas/#:~:text=In%20this%20case%2C%20when%20we,and%20unenforceable%20under%20California%20law.>

[^amn-void]: **AMN Healthcare, Inc. v. Aya Healthcare Services, Inc.** — "Turning to the instant case, we independently conclude that the nonsolicitation of employee provision in the CNDA is void under section 1660

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/colorado.md (reported line 218)May include surrounding context.

md

blished by the attorney general, by rule, regarding the transferability of the training or credentialing that is available to the employee as a result of the training." *C.R.S. § 8-2-113(3)(a).* <https://olls.info/crs/crs2025-title-08.pdf>

[^phoenix-employer-burden]: **Phoenix Capital, Inc. v. Dowell** — "In the preliminary injunction context, the employer has the burden to establish that the covenant not to compete falls within one of those narrow exceptions." *Phoenix Capital, Inc. v. Dowell, 176 P.3d 835 (Colo. App. 2007).* <https://www.courtlistener.com/opinion/2633761/phoenix-capital-inc-v-dowell/#:~:text=In%20the%20preliminary%20injunction%20context%2C,one%20of%20those%20narrow%20exceptions.>

[^crs-hcw-exception]: **C.R.S. § 8-2-113** — "Except for a covenant not to compete that restricts the practice of medicine, the practice of advanced practice registered nursing, or the practice of dentistry in this state, this subsection (2) does not apply to a covenant not to compet

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/connecticut.md (reported line 189)May include surrounding context.

md

le is for informational purposes only and does not create an attorney-client relationship. CC BY 4.0. Cite as Steven Obiajulu, *Non-Competes in Connecticut*, OpenAgreements (last updated June 2, 2026), https://openagreements.org/practice-guides/non-compete/us/connecticut.

[^scott-employee-noncompete-reasonableness]: **Scott v. General Iron & Welding Co.** — "In order to be valid and binding, a covenant which restricts the activities of an employee following the termination of his employment must be partial and restricted in its operation ‘in respect either to time or place, . . . and must be reasonable — that is, it should afford only a fair protection to the interest of the party in whose favor it is made and must not be so large in its operation as to interfere with the interests of the public." *Scott v. Gen. Iron & Welding Co., 171 Conn. 132 (1976).* <https://www.courtlistener.com/opinion/2268855/scott-v-general-iron-welding-co/#:~:text=In%20order%20to%20be%20valid,the%20int

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/delaware.md (reported line 183)May include surrounding context.

md

attorney. This article is for informational purposes only and does not create an attorney-client relationship. CC BY 4.0. Cite as Steven Obiajulu, *Non-Competes in Delaware*, OpenAgreements (last updated June 2, 2026), https://openagreements.org/practice-guides/non-compete/us/delaware.

[^fp-uc-reasonableness-test]: **FP UC Holdings, LLC v. Hamilton** — "Instead, our courts carefully review the covenants to assure they ‘(1) [are] reasonable in geographic scope and temporal duration, (2) advance a legitimate economic interest of the party seeking its enforcement, and (3) survive a balancing of the equities.’" *FP UC Holdings, LLC v. Hamilton, 2020 WL 1492783, at *6 (Del. Ch. Mar. 27, 2020).* <https://www.courtlistener.com/opinion/4739986/fp-uc-holdings-llc-fpmcm-llc-and-fast-pace-medical-clinic-pllc-v/#:~:text=Instead%2C%20our%20courts%20carefully%20review,a%20balancing%20of%20the%20equities.%E2%80%9D>

[^sunder-chancery-holistic-review]: **Sunder Energy, LLC v. Jackson** — "Whe

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/district-of-columbia.md (reported line 245)May include surrounding context.

md

n in a written agreement or a workplace policy that prohibits an employee from performing work for another for pay or from operating the employee's own business." *D.C. Code § 32-581.01(15).* <https://code.dccouncil.gov/us/dc/council/code/sections/32-581.01>

[^dc-cust-ellis-partial]: **Ellis v. James V. Hurson Associates, Inc.** — "we join those jurisdictions which have rejected the view that covenants not to compete must be enforceable in whole or not at all." *Ellis v. James V. Hurson Assocs., Inc., 565 A.2d 615, 618 (D.C. 1989).* <https://www.courtlistener.com/opinion/1561257/ellis-v-james-v-hurson-associates-inc/#:~:text=we%20join%20those%20jurisdictions%20which,whole%20or%20not%20at%20all.>

[^sale-carveout]: **D.C. Code § 32-581.01** — "Contained within or executed contemporaneously with an agreement between the seller of a business and one or more buyers of that business wherein the seller agrees not to compete with the buyer's business" *D.C. Code § 32-581.01(15)(A).* <

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/florida.md (reported line 192)May include surrounding context.

md

y specified restraint is reasonably necessary to protect the legitimate business interest or interests justifying the restriction." *Fla. Stat. § 542.335(1)(c) (2025).* <https://www.flsenate.gov/Laws/Statutes/2025/542.335>

[^q1-henao-framework]: **Henao v. Professional Shoe Repair, Inc.** — "Section 542.335 contains a comprehensive framework for analyzing, evaluating and enforcing restrictive covenants in Florida based on an ‘unfair competition’ analysis." *Henao v. Prof'l Shoe Repair, Inc., 929 So. 2d 723 (Fla. 5th DCA 2006).* <https://www.courtlistener.com/opinion/1825627/henao-v-professional-shoe-repair-inc/#:~:text=Section%20542.335%20contains%20a%20comprehensive,on%20an%20%22unfair%20competition%22%20analysis.>

[^q1-choice-fallback]: **Fla. Stat. § 542.45** — "Any action regarding a restrictive covenant that does not meet the definition of a covered garden leave agreement or a covered noncompete agreement as provided in this part is governed by s. 542.335." *Fla. Stat.

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/georgia.md (reported line 303)May include surrounding context.

md

e owner or seller as a result of any sale referred to in this subsection, measured from the date of termination or disposition of such interest." *O.C.G.A. § 13-8-57(d).* <https://www.legis.ga.gov/api/legislation/document/20112012/114248>

[^q4-wimmer-no-express-term]: **North American Senior Benefits, LLC v. Wimmer** — "The petitioner — a Georgia corporation seeking to enforce a restrictive covenant against two former employees — asks us to review the conclusion reached by the Court of Appeals that, to be deemed geographically reasonable under OCGA § 13-8-53 (a), a restrictive covenant must contain an express geographic term. In light of the statutory text and context of the GRCA, we conclude that the Court of Appeals erred, so we reverse and remand this case for further proceedings." *North American Senior Benefits, LLC v. Wimmer, 319 Ga. 641 (2024).* <https://www.courtlistener.com/opinion/10680273/north-american-senior-benefits-llc-v-wimmer/#:~:text=The%20petitioner%20%E2%80

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/hawaii.md (reported line 166)May include surrounding context.

md

employment, within such time as may be reasonably necessary for the protection of the employer or principal, without imposing undue hardship on the employee or agent." *Haw. Rev. Stat. 480-4(c).* <https://www.capitol.hawaii.gov/hrscurrent/Vol11_Ch0476-0490/HRS0480/HRS_0480-0004.htm>

[^employee-gagnon-legitimate-purpose-required]: **Prudential Locations, LLC v. Gagnon** — "Even if a restrictive covenant otherwise satisfies the Traeger three-factor reasonableness test, it is unenforceable unless it is ancillary to a legitimate purpose not violative of Chapter 480." *Prudential Locations, LLC v. Gagnon, 151 Haw. 136, 509 P.3d 1099 (2022).* <https://www.courtlistener.com/opinion/6358303/prudential-locations-llc-v-gagnon/#:~:text=Even%20if%20a%20restrictive%20covenant,not%20violative%20of%20Chapter%20480.>

[^employee-gagnon-competition-not-purpose]: **Prudential Locations, LLC v. Gagnon** — "Preventing competition, however, is not a legitimate ancillary purpose under HRS § 480-4(a)."

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/idaho.md (reported line 252)May include surrounding context.

md

rum selection clauses in the purchase agreement and the LLC agreement." *Off-Spec Sols., LLC v. Transp. Invs., LLC, No. 47940 (Idaho May 19, 2021).* <https://www.courtlistener.com/opinion/10732800/off-spec-solutions-llc-v-transportation-investors-llc/#:~:text=Therefore%2C%20we%20hold%20that%20Idaho,agreement%20and%20the%20LLC%20agreement.>

[^bybee-sale-goodwill]: **Bybee v. Isaac** — "When the covenant not to compete is ancillary to the sale of a business, any decision on the reasonableness of the covenants must recognize ‘that the vendee is usually purchasing the good will of the business and thus is entitled to reasonable protection from competition by the seller.’" *Bybee v. Isaac, 145 Idaho 251, 178 P.3d 616 (2008).* <https://www.courtlistener.com/opinion/2507705/bybee-v-isaac/#:~:text=When%20the%20covenant%20not%20to,from%20competition%20by%20the%20seller.%E2%80%9D>

[^bybee-not-overbroad]: **Bybee v. Isaac** — "However, when viewing the non-compete covenant in this case

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/illinois.md (reported line 218)May include surrounding context.

md

greater than is required for the protection of a legitimate business interest of the employer, (4) the covenant does not impose undue hardship on the employee, and (5) the covenant is not injurious to the public." *820 ILCS 90/15.* <https://www.ilga.gov/documents/legislation/ilcs/documents/082000900K15.htm>

[^reliable-fire-3prong]: **Reliable Fire Equipment Co. v. Arredondo** — "A restrictive covenant, assuming it is ancillary to a valid employment relationship, is reasonable only if the covenant: (1) is no greater than is required for the protection of a legitimate business interest of the employer-promisee; (2) does not impose undue hardship on the employee-promisor, and (3) is not injurious to the public." *Reliable Fire Equipment Co. v. Arredondo, 2011 IL 111871.* <https://www.courtlistener.com/opinion/3135645/reliable-fire-equipment-co-v-arredondo/#:~:text=A%20restrictive%20covenant%2C%20assuming%20it,not%20injurious%20to%20the%20public.>

[^ifwa-10-noncompete-threshold]: **82

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/indiana.md (reported line 204)May include surrounding context.

md

ana-admitted attorney. This article is for informational purposes only and does not create an attorney-client relationship. CC BY 4.0. Cite as Steven Obiajulu, *Non-Competes in Indiana*, OpenAgreements (last updated June 3, 2026), https://openagreements.org/practice-guides/non-compete/us/indiana.

[^krueger-strict-construction]: **Central Indiana Podiatry, P.C. v. Krueger** — "We construe these covenants strictly against the employer and will not enforce an unreasonable restriction." *Central Indiana Podiatry, P.C. v. Krueger, 882 N.E.2d 723 (Ind. 2008).* <https://www.courtlistener.com/opinion/852486/central-indiana-podiatry-pc-v-krueger/#:~:text=We%20construe%20these%20covenants%20strictly,not%20enforce%20an%20unreasonable%20restriction.>

[^dicen-disfavored]: **Dicen v. New Sesco, Inc.** — "Covenants not to compete are not favored in the law." *Dicen v. New Sesco, Inc., 839 N.E.2d 684 (Ind. 2005).* <https://www.courtlistener.com/opinion/852724/dicen-v-new-sesco-inc/#:~:text=Coven

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/iowa.md (reported line 200)May include surrounding context.

md

95 N.W.2d 751 (Iowa 1999).* <https://www.courtlistener.com/opinion/1989929/revere-transducers-inc-v-deere-co/#:~:text=(1)%20Is%20the%20restriction%20reasonably,prejudicial%20to%20the%20public%20interest%3F>

[^q2-lamp-three-prong]: **Lamp v. American Prosthetics, Inc.** — "Because this case was tried in equity, our review is de novo. Iowa R.App.P. 4. In deciding whether to enforce a restrictive covenant, the court will apply a three-pronged test: (1) Is the restriction reasonably necessary for the protection of the employer’s business; (2) is it unreasonably restrictive of the employee’s rights; and (3) is it prejudicial to the public interest?" *Lamp v. American Prosthetics, Inc., 379 N.W.2d 909 (Iowa 1986).* <https://www.courtlistener.com/opinion/1601399/lamp-v-american-prosthetics-inc/#:~:text=Because%20this%20case%20was%20tried,prejudicial%20to%20the%20public%20interest%3F>

[^q2-iowa-glass-burden]: **Iowa Glass Depot, Inc. v. Jindrich** — "The burden of proving reasonablen

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/kansas.md (reported line 191)May include surrounding context.

md

is not legal advice from a Kansas-admitted attorney. This article is for informational purposes only and does not create an attorney-client relationship. CC BY 4.0. Cite as Steven Obiajulu, *Non-Competes in Kansas*, OpenAgreements (last updated June 2, 2026), https://openagreements.org/practice-guides/non-compete/us/kansas.

[^weber-governing-standard]: **Weber v. Tillman** — "A noncompetition covenant ancillary to an employment contract is valid and enforceable if the restraint is reasonable under the circumstances and not adverse to the public welfare." *Weber v. Tillman, 259 Kan. 457, 913 P.2d 84 (1996).* <https://www.courtlistener.com/opinion/7969238/weber-v-tillman/#:~:text=A%20noncompetition%20covenant%20ancillary%20to,adverse%20to%20the%20public%20welfare.>

[^q2-weber-four-factor]: **Weber v. Tillman** — "The analysis of whether the noncompetition clause is reasonable evaluates these factors: (1) Does the covenant protect a legitimate business interest of the employer? (2)

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/kentucky.md (reported line 206)May include surrounding context.

md

-compete clause if the initial restrictions are overly broad or burdensome." *Kegel v. Tillotson, 297 S.W.3d 908 (Ky. App. 2009).* <https://www.courtlistener.com/opinion/2169063/kegel-v-tillotson/#:~:text=our%20courts%20have%20adopted%20a,are%20overly%20broad%20or%20burdensome.>

[^hodges-reformation-geography]: **Hodges v. Todd** — "we hold that the trial court had the authority to enforce the covenant by establishing a reasonable geographical limitation based on the intention of the parties at the time the contract was executed." *Hodges v. Todd, 698 S.W.2d 317 (Ky. App. 1985).* <https://www.courtlistener.com/opinion/1781513/hodges-v-todd/#:~:text=we%20hold%20that%20the%20trial,time%20the%20contract%20was%20executed.>

[^ky-ens-kegel]: **Kegel v. Tillotson** — "agreements on restraint of trade are reasonable if, ‘on consideration of the subject, nature of the business, situation of the parties and circumstances of the particular case, the restriction is such only as to afford f

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/louisiana.md (reported line 232)May include surrounding context.

md

La. R.S. 23:921** — "Every contract or agreement, or provision thereof, by which anyone is restrained from exercising a lawful profession, trade, or business of any kind, except as provided in this Section, shall be null and void." *La. R.S. 23:921(A)(1).* <https://legis.la.gov/Legis/Law.aspx?d=84015>

[^swat24-strict-construction]: **SWAT 24 Shreveport Bossier, Inc. v. Bond** — "Because such covenants are in derogation of the common right, they must be strictly construed against the party seeking their enforcement." *SWAT 24 Shreveport Bossier, Inc. v. Bond, 808 So. 2d 294 (La. 2001).* <https://www.courtlistener.com/opinion/1860745/swat-24-shreveport-bossier-inc-v-bond/#:~:text=Because%20such%20covenants%20are%20in,the%20party%20seeking%20their%20enforcement.>

[^rs-23921-c]: **La. R.S. 23:921** — "Any person, including a corporation and the individual shareholders of such corporation, who is employed as an agent, servant, or employee may agree with his employer to refrain from

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/maine.md (reported line 162)May include surrounding context.

md

(Me. 1983).* <https://www.courtlistener.com/opinion/2367150/lord-v-lord/#:~:text=We%20have%20long%20recognized%20that,the%20business%20interests%20in%20issue.>

[^sisters-duration-geography-interest]: **Sisters of Charity Health System, Inc. v. Farrago** — "Although reasonableness is a question of law, the inquiry is fact-intensive, and it depends on the specific circumstances of the case: the covenant’s duration, the scope of the specified geographic area, and the nature of the interest to be protected." *Sisters of Charity Health Sys., Inc. v. Farrago, 2011 ME 62, ¶ 10, 21 A.3d 110.* <https://www.courtlistener.com/opinion/2444708/sisters-of-charity-health-system-inc-v-farrago/#:~:text=Although%20reasonableness%20is%20a%20question,the%20interest%20to%20be%20protected.>

[^maine-599a-prohibited-workers]: **26 M.R.S. § 599-A — Noncompete agreements** — "The employee is earning wages at or below 400% of the federal poverty level; or" *26 M.R.S. § 599-A(3)(A).* <https://legisl

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/maryland.md (reported line 217)May include surrounding context.

md

ed attorney. This article is for informational purposes only and does not create an attorney-client relationship. CC BY 4.0. Cite as Steven Obiajulu, *Non-Competes in Maryland*, OpenAgreements (last updated June 3, 2026), https://openagreements.org/practice-guides/non-compete/us/maryland.

[^seneca-four-part-test]: **Seneca One Finance, Inc. v. Bloshuk** — "In Maryland, a restrictive employment covenant will only be enforced if it meets four requirements: ‘(1) the employer must have a legally protected interest, (2) the restrictive covenant must be no wider in scope and duration than is reasonably necessary to protect the employer’s interest, (3) the covenant cannot impose an undue hardship on the employee, and (4) the covenant cannot violate public policy.’" *Seneca One Fin., Inc. v. Bloshuk, 214 F. Supp. 3d 457 (D. Md. 2016).* <https://www.courtlistener.com/opinion/7322313/seneca-one-finance-inc-v-bloshuk/#:~:text=In%20Maryland%2C%20a%20restrictive%20employment,covenant%20can

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/massachusetts.md (reported line 213)May include surrounding context.

md

1%2C%202018%2C%22>

[^mnaa-employee-scope]: **Mass. Gen. Laws ch. 149, § 24L** — "provided, however, that the term ''employee'', as used in this section, shall also include independent contractors under section 148B." *Mass. Gen. Laws ch. 149, § 24L(a).* <https://malegislature.gov/Laws/GeneralLaws/Chapter149/Section24L>

[^boulanger-reasonableness]: **Boulanger v. Dunkin' Donuts Inc.** — "A covenant not to compete is enforceable only if it is necessary to protect a legitimate business interest, reasonably limited in time and space, and consonant with the public interest." *Boulanger v. Dunkin' Donuts Inc., 442 Mass. 635 (2004).* <https://www.courtlistener.com/opinion/6579005/boulanger-v-dunkin-donuts-inc/#:~:text=A%20covenant%20not%20to%20compete%20is,consonant%20with%20the%20public%20interest.>

[^formation-newhire]: **Mass. Gen. Laws ch. 149, § 24L** — "If the agreement is entered into in connection with the commencement of employment, it must be in writing and signed by bot

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/michigan.md (reported line 217)May include surrounding context.

md

ation of employment if the agreement or covenant is reasonable as to its duration, geographical area, and the type of employment or line of business." *MCL § 445.774a(1).* <https://legislature.mi.gov/Laws/MCL?objectName=mcl-445-774a>

[^borgiel-unfair-advantage]: **St. Clair Medical, P.C. v. Borgiel** — "To be reasonable in relation to an employer's competitive business interest, a restrictive covenant must protect against the employee's gaining some unfair advantage in competition with the employer, but not prohibit the employee from using general knowledge or skill." *St. Clair Med., P.C. v. Borgiel, 270 Mich. App. 260 (2006).* <https://www.courtlistener.com/opinion/2026165/st-clair-medical-pc-v-borgiel/#:~:text=To%20be%20reasonable%20in%20relation,using%20general%20knowledge%20or%20skill.>

[^follmer-confidential-info]: **Follmer, Rudzewicz & Co., P.C. v. Kosco** — "To the extent such an agreement provides reasonable protection for the confidential information of the employer,

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/mississippi.md (reported line 249)May include surrounding context.

md

e employer, the rights of the employee, and the rights of the public." *Texas Road Boring Co. of La.-Miss. v. Parker, 194 So. 2d 885 (Miss. 1967).* <https://www.courtlistener.com/opinion/1880375/texas-road-boring-co-of-louisiana-miss-v-parker/#:~:text=Non%2Dcompetition%20agreements%20are%20not%20favored,the%20rights%20of%20the%20public.>

[^cooper-general-application]: **Cooper v. Gidden** — "A covenant not to compete will be given general application unless, by its own terms, it specifically expresses an intent that it be a personal covenant flowing only to the original obligee." *Cooper v. Gidden, 515 So. 2d 900 (Miss. 1987).* <https://www.courtlistener.com/opinion/1898073/cooper-v-gidden/#:~:text=A%20covenant%20not%20to%20compete%20will,only%20to%20the%20original%20obligee.>

[^cascio-extension-clause-x]: **Cascio v. Cascio Investments, LLC** — "[Cascio] will execute a non-compete agreement with CSW for a period of five years covering Mississippi, Arkansas, Louisiana, Tennessee,

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/missouri.md (reported line 192)May include surrounding context.

md

secrets or customer contacts." *Healthcare Servs. of the Ozarks, Inc. v. Copeland, 198 S.W.3d 604 (Mo. banc 2006).* <https://www.courtlistener.com/opinion/1654936/healthcare-services-of-the-ozarks-inc-v-copeland/#:~:text=In%20addition%2C%20such%20restrictions%20are,trade%20secrets%20or%20customer%20contacts.>

[^yates-presumptively-void]: **Payroll Advance, Inc. v. Yates** — "Generally, because covenants not to compete are considered to be restraints on trade, they are presumptively void and are enforceable only to the extent that they are demonstratively reasonable." *Payroll Advance, Inc. v. Yates, 270 S.W.3d 428 (Mo. App. S.D. 2008).* <https://www.courtlistener.com/opinion/1590178/payroll-advance-inc-v-yates/#:~:text=Generally%2C%20because%20covenants%20not%20to,that%20they%20are%20demonstratively%20reasonable.>

[^whelan-employer-burden]: **Whelan Security Co. v. Kennebrew** — "The employer has the burden to prove that the non-compete agreement protects its legitimate interests

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · content/montana.md (reported line 165)May include surrounding context.

md

ire & Tucker, P.C. v. Rutherford, MacDonald & Olson, 218 Mont. 392, 708 P.2d 577 (1985).* <https://www.courtlistener.com/opinion/1183224/dobbins-deguire-tucker-pc-v-rutherford-macdonald-olson/#:~:text=We%20hold%20that%20the%20written,prohibited%20by%20Section%2028%2D2%2D703%2C%20MCA.>

[^dobbins-three-part-test]: **Dobbins, DeGuire & Tucker, P.C. v. Rutherford, MacDonald & Olson** — "‘(1) the covenant should be limited in operation either as to time or place; (2) the covenant should be based on some good consideration; and (3) the covenant should afford a reasonable protection for and not impose an unreasonable burden upon the employer, the employee or the public.’" *Dobbins, DeGuire & Tucker, P.C. v. Rutherford, MacDonald & Olson, 218 Mont. 392, 708 P.2d 577 (1985).* <https://www.courtlistener.com/opinion/1183224/dobbins-deguire-tucker-pc-v-rutherford-macdonald-olson/#:~:text=%E2%80%9C(1)%20the%20covenant%20should%20be,the%20employee%20or%20the%20public.%E2%80%9D>

[^alborn-dobb

Static analysis

No suspicious patterns detected.