Safe

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 0.2.2

Overview

The skill is purpose-aligned for drafting SAFE documents, but its local setup and temporary-file instructions have security-relevant contradictions for sensitive financing data.

Review carefully before installing. Prefer the remote MCP only if you are comfortable sending SAFE field values to openagreements.org, or use the local CLI with a pinned package version and a unique mktemp values file rather than a fixed /tmp path. Generated SAFE documents should be reviewed by counsel before signing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: template-filling-execution.md:78

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: template-filling-execution.md:78-83, with related instructions in SKILL.md:72-77 and CONNECTORS.md:15-19
Vulnerability Type: Supply-chain exposure through inconsistent dependency pinning
Risk Level: Medium

Vulnerable Code Snippets

template-filling-execution.md:78-83:

markdown

- Easiest: configure the remote MCP (see Step 1)
- Alternative: install Node.js 20+ and `npm install -g open-agreements`

CONNECTORS.md:15-19:

markdown

### Alternative: Local CLI

For fully local execution (no network calls during fills), install [`open-agreements` from npm](https://www.npmjs.com/package/open-agreements). Requires Node.js >= 20. See the [README](https://github.com/open-agreements/open-agreements#use-with-claude-code) for details.

This conflicts with the pinned instruction in SKILL.md:72-77:

markdown

2. **Pin the CLI version** (`npm install -g open-agreements@0.7.5`, not `@latest`) to avoid surprises from unpinned upstream changes.

Technical Analysis

The primary security guidance explicitly requires version 0.7.5, but the executable workflow tells users to run an unpinned global npm installation. The connector documentation also directs users to install the package without specifying a reviewed version.

An unpinned command resolves the package version associated with the registry's current default distribution tag at installation time. Consequently, the code installed and any npm lifecycle scripts executed can differ from the version reviewed when this Skill was published. A compromised maintainer account, malicious release, or unexpected upstream change could therefore introduce arbitrary code into the installation process.

Global installation increases the potential scope because the package is made available system-wide for the current Node.js installation. The precise privileges depend on how npm is configured and whether th ...[truncated 1327 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every installation instruction with the reviewed version:

   bash

   npm install -g open-agreements@0.7.5
   

2. Update CONNECTORS.md to state the exact approved package version rather than referring only to the package landing page.
3. Centralize the approved version in one authoritative workflow and validate documentation consistency in CI.
4. Verify the package integrity and provenance before installation, and document the expected registry and integrity digest where practical.
5. Review new releases before changing the pinned version.
6. Warn users not to use sudo or another elevated account for installation unless it is strictly required.
7. Prefer a project-local, locked dependency over a global installation when the runtime architecture permits it.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:40

Finding

Conflicting Temporary-File Rules Permit Use of a Predictable Shared Path

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:40-45, conflicting with template-filling-execution.md:55-67
Vulnerability Type: Predictable temporary file and ambiguous security configuration
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:40-45:

markdown

2. **No shell metacharacters** in any field value written to `/tmp/oa-values.json`: reject backtick, `$(`, semicolon, pipe, ampersand, and redirects.
3. **Fixed temp path**: use `/tmp/oa-values.json` exactly — do not let users redirect it.
4. **Heredoc quoting**: when writing field values, use a quoted heredoc (`<< 'FIELDS'`) so shell variable expansion does not apply.

The shared workflow instead requires a unique temporary file in template-filling-execution.md:55-67:

bash

VALUES_FILE="$(mktemp /tmp/oa-values.XXXXXX.json)"
chmod 600 "$VALUES_FILE"
trap 'rm -f "$VALUES_FILE"' EXIT

cat > "$VALUES_FILE" << 'FIELDS'
{
  "field_name": "value"
}
FIELDS

It then states:

markdown

Do not reuse a shared temp filename for confidential values.

Technical Analysis

SKILL.md mandates the predictable path /tmp/oa-values.json, while the referenced execution workflow mandates a securely generated per-run path and explicitly prohibits shared temporary filenames. SKILL.md also claims that the workflow documents the same rules, making the intended authoritative behavior unclear.

A predictable filename in a shared temporary directory is unsafe when the writer does not securely create the file and verify its type and ownership. Another local process or user may pre-create that path, create a symbolic link at that path, or exploit concurrent runs. Merely quoting the heredoc does not address filesystem race conditions or symbolic-link traversal.

Because the file contains confidential financing terms, unsafe creation can cause disclosure. If a privileged process follows a malicious symbolic link, w ...[truncated 2005 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requirement to use /tmp/oa-values.json.
2. Make the unique-file workflow authoritative everywhere:

   bash

   VALUES_FILE="$(mktemp /tmp/oa-values.XXXXXX.json)" || exit 1
   chmod 600 "$VALUES_FILE" || exit 1
   trap 'rm -f -- "$VALUES_FILE"' EXIT
   

3. State explicitly that the path must be generated by mktemp and must not be supplied by the user or derived from template data.
4. Verify that the resulting path is a regular file owned by the current user before writing sensitive values.
5. Retain the quoted heredoc, but clarify that it mitigates shell expansion rather than filesystem attacks.
6. Delete the temporary file immediately after rendering, while retaining the exit trap as fallback cleanup.
7. Add a documentation consistency test that fails if any file recommends a fixed or shared values-file path.
8. Consider writing the JSON through a language-native secure temporary-file API to avoid shell interpolation and manual JSON-escaping errors.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

ecution.md) documents the same rules. This section exists so a scanner reading `SKILL.md` alone can verify that the skill acknowledges shell safety.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says to use the skill when the user says phrases including "documents" and especially "fundraising paperwork," which are broad and could overlap with many ordinary requests that are not specifically about YC SAFE drafting. The file does not provide negative examples or explicit exclusion conditions to narrow when the skill should not activate.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · template-filling-execution.md (reported line 58)May include surrounding context.

If Local CLI: Write values to a per-run temporary JSON file with restrictive permissions:

bash

VALUES_FILE="$(mktemp /tmp/oa-values.XXXXXX.json)"
chmod 600 "$VALUES_FILE"
trap 'rm -f "$VALUES_FILE"' EXIT

cat > "$VALUES_FILE" << 'FIELDS'

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file recommends a remote MCP endpoint for contract templates but does not explicitly warn that using it may transmit document contents or fundraising data to an external service. In a legal-document drafting skill, users may provide sensitive company, investor, and financing terms, so the lack of a clear network/data-sharing notice creates a real privacy and data-handling risk even if the connector itself is legitimate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.