ClawHub
Back to skill

Security audit

Open Agreements

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and mostly disclosed, but it recommends remote processing of sensitive legal data and documents a legacy API-key-in-URL flow without enough per-use control or warning.

Review before installing if your agreements contain confidential, regulated, or high-value business terms. Prefer the local CLI path for sensitive documents, avoid the legacy API-key URL flow, do not run npm with elevated privileges, and confirm before sending any completed agreement to DocuSign.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:155
Finding

Remote Processing Is Preferred Without Requiring Explicit Per-Document Consent

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:155-160
Supporting Locations: SKILL.md:12-15; template-filling-execution.md:14-27, 53, 72-74; CONNECTORS.md:11-14
Vulnerability Type: Transmission of confidential contract and signer data to a third-party service
Risk Level: Medium

Vulnerable Code Snippet

markdown
| Path | Install-time network | Runtime network |
|------|---------------------|----------------|
| **Pinned global install** (`npm install -g open-agreements@0.7.4`) | One-time fetch from `registry.npmjs.org` | None for `list`/`fill`. DocuSign API only at signing time. |
| **Pinned npx** (`npx -y open-agreements@0.7.4`) | Fetch from `registry.npmjs.org` on first run, cached afterward | Same as above |
| **Remote MCP** (`https://openagreements.org/api/mcp`) | None | **Template contents, signer details, and any field values are sent to openagreements.org.** Use only if you accept transmitting these values to the hosted service. |
| **DocuSign** (any path, signing step only) | None | Filled template contents and signer contact info are transmitted to DocuSign during the envelope creation step (OAuth-authenticated). |

**Use the local CLI path** (global or npx) if you need guaranteed offline behavior with no third-party data transfer beyond DocuSign at signing time.

The shared workflow nevertheless makes remote processing the first preference:

markdown
1. **Remote MCP** (recommended): Check if the `open-agreements` MCP server is available (provides `list_templates`, `get_template`, `fill_template` tools). Zero local dependencies — server handles DOCX generation and returns a download URL.

Technical Analysis

The Skill collects legal-agreement field values that may include confidential contract terms, company information, names, addresses, investment details, and signer contact information. Under the preferred Remote MCP path, these values are sent to `openagreements ...[truncated 2101 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make the local CLI the default for document filling when it is available.
  2. Before each remote fill, require explicit user confirmation that identifies:
    • the destination service;
    • the specific data categories being transmitted;
    • whether the document contains confidential or regulated information;
    • the availability of a local alternative.
  3. Do not treat general acceptance of the Skill as consent to transmit each agreement.
  4. Minimize the transmitted data and omit optional fields that are unnecessary for rendering.
  5. Support placeholders or redaction where users can insert sensitive values locally after generation.
  6. Document service-side retention, deletion, encryption, data-residency, access-control, and subprocessor policies.
  7. Provide a mechanism to delete remotely generated documents and associated field values.
  8. Apply the same consent requirement before transmitting completed documents and signer details to DocuSign.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:50
Finding

Legacy OAuth Initiation Places an API Key in a URL Query Parameter

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:50
Vulnerability Type: Sensitive credential exposure through a URL query string
Risk Level: High

Vulnerable Code Snippet

markdown
**Transport note:** `connect_signing_provider` is local-MCP-only. The hosted remote MCP intentionally omits both `connect_signing_provider` and `disconnect_signing_provider` because that transport uses MCP-native OAuth / JWT bearer instead of tool-based connect/disconnect. Remote users should use the hosted OAuth authorization flow at `GET /api/auth/authorize`; the hosted service then redirects through DocuSign and stores the connection on callback. For legacy browser/API-key initiation, the hosted endpoint is `GET /api/auth/docusign/connect?key=<open_agreements_api_key>`. Remote disconnect is handled by `POST /api/auth/revoke`.

Technical Analysis

The legacy authentication flow embeds an Open Agreements API key in the key query parameter. URL query strings are commonly retained by browser history, reverse proxies, load balancers, web-server access logs, monitoring products, endpoint-security tools, support diagnostics, and copied links. Depending on referrer policy and redirect behavior, URLs may also be exposed to other web origins.

HTTPS protects the URL while it is in transit but does not prevent disclosure through either endpoint's logs, browser state, or operational telemetry. The Skill calls this a legacy path, but it still documents a usable credential-bearing endpoint without warning users against it or requiring short-lived credentials.

Attack Path

  1. A user or agent constructs the documented URL with a valid Open Agreements API key.
  2. The URL is opened in a browser to initiate the DocuSign connection.
  3. The complete URL is retained in one or more browser, proxy, server, observability, or security logs.
  4. An attacker, administrator, support operator, browser extension, or compromised monitoring acc ...[truncated 781 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove and disable the legacy query-parameter authentication flow.
  2. Transmit API credentials through an Authorization header rather than a URL.
  3. Prefer the documented OAuth 2.0 authorization flow with PKCE.
  4. Use short-lived, single-use, audience-bound authorization codes instead of reusable API keys.
  5. Ensure authorization state is cryptographically random, expires quickly, and is bound to the initiating session.
  6. Redact query strings from proxy, application, analytics, and monitoring logs.
  7. Apply a restrictive Referrer-Policy, such as no-referrer, to authentication endpoints.
  8. Rotate any key that has already been used in the query-string flow.
  9. Scope credentials to the minimum required permissions and enforce server-side rate limits and anomaly detection.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:103
Finding

External npm Package Is Downloaded and Executed Without Artifact Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:103-109
Supporting Locations: SKILL.md:155-156, 163-182; template-filling-execution.md:78-83
Vulnerability Type: Unverified third-party dependency download and execution
Risk Level: Medium

Vulnerable Code Snippet

markdown
```bash
if command -v open-agreements >/dev/null 2>&1; then
  echo "GLOBAL"
elif command -v node >/dev/null 2>&1; then
  echo "NPX"
else
  echo "PREVIEW_ONLY"
fi
  • GLOBAL: Use open-agreements directly.
  • NPX: Use npx -y open-agreements@0.7.4 as prefix. Always pin the version — never use @latest to avoid pulling unexpected updates.
  • PREVIEW_ONLY: No Node.js. Generate markdown preview only.
text

The Skill also recommends global installation:

```bash
npm install -g open-agreements@0.7.4

Technical Analysis

The audited project contains only Markdown instructions and does not include the npm package source or a cryptographic integrity value for the package artifact. The npx -y path automatically downloads and executes package code without an interactive package-install confirmation. The global installation path places an executable in a broadly accessible system or user-level npm prefix.

Pinning open-agreements to version 0.7.4 materially reduces the risk of silently receiving a future top-level version. It does not, within this Skill artifact, establish that the retrieved package matches a reviewed source tree, validate package provenance, constrain transitive dependencies, or sandbox execution. The assertion that the package has no install hooks is useful but is not itself an enforceable integrity control.

This is a supply-chain risk rather than evidence that the named package is malicious. No embedded malicious script, obfuscated payload, or intentional package substitution was found in the audited project.

Attack Path

  1. The agent determines t ...[truncated 1412 chars]
Remediation
View remediation

Remediation Suggestions

  1. Avoid automatic npx -y execution for security-sensitive document workflows.
  2. Vendor and audit the required package, or distribute a verified artifact with a published SHA-256 or stronger integrity value.
  3. Verify package provenance and signatures before execution.
  4. Lock all transitive dependencies and review the resolved dependency graph.
  5. Use a private, controlled registry or an approved artifact repository where appropriate.
  6. Run the CLI in a sandbox or container with:
    • no unnecessary network access;
    • read-only access outside designated input and output directories;
    • no inherited cloud or signing credentials;
    • a non-privileged user;
    • explicit CPU, memory, and execution-time limits.
  7. Avoid global installation and never run npm installation commands with administrative privileges.
  8. Require explicit user approval before the first package download and execution.
  9. Revalidate the package's scripts and integrity during upgrades rather than relying solely on documentation.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

open-agreements fill -d /tmp/oa-values.json -o .docx

text

Clean up: `rm /tmp/oa-values.json`

## Source Code and Audit

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
## CRITICAL: DocuSign and Authentication

- **Open Agreements handles DocuSign OAuth automatically.** Do NOT ask the user for a DocuSign API key or integration key.
- **Do NOT tell the user to install or configure DocuSign separately.** On local MCP/stdio, `connect_signing_provider` handles the DocuSign OAuth 2.0 + PKCE flow. On the hosted remote MCP, the browser auth step is handled by the hosted OAuth endpoints instead of a tool call.
- **Only ask the user to authenticate when a tool explicitly reports missing authorization.** Do not preemptively ask for credentials.
- **Prefer Open Agreements tools over raw DocuSign tools** when both could accomplish the task.

Unbounded Output

Medium
Category
Output Handling
Confidence
80% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md
- **Remote MCP**: https://openagreements.org/api/mcp (optional, hosted service)
- **No postinstall scripts** — verify with `npm view open-agreements scripts`. The package declares no `postinstall`, `preinstall`, or `install` hooks. The `prepare` script only runs when installing from a git URL, not from the npm registry.

All template field definitions, fill logic, and DocuSign integration code are auditable in the repository.

### A note on versions

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · template-filling-execution.md (reported line 58)May include surrounding context.

If Local CLI: Write values to a per-run temporary JSON file with restrictive permissions:

bash
VALUES_FILE="$(mktemp /tmp/oa-values.XXXXXX.json)"
chmod 600 "$VALUES_FILE"
trap 'rm -f "$VALUES_FILE"' EXIT

cat > "$VALUES_FILE" << 'FIELDS'

Static analysis

No suspicious patterns detected.