Security audit

Venture Financing

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed venture-financing document generator, with remote processing and optional local CLI use that fit its stated purpose.

Before using the remote MCP, treat entered financing terms as confidential and confirm you are comfortable sending them to the hosted Open Agreements service and sharing the returned download URL. For highly sensitive transactions, prefer the local CLI or preview-only path and review all generated documents with counsel before signing.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: template-filling-execution.md:13
Finding: Confidential Legal and Financing Data Is Sent to a Remote Service Without Transaction-Specific Consent
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: template-filling-execution.md:83
Finding: Unpinned Global npm Installation Exposes Users to Supply-Chain Release Drift
Content: View full analysis
Remediation: View remediation
``` Use `--ignore-scripts` only after confirming that legitimate installation does not require lifecycle scripts. 2. Publish and verify the expected package integrity hash, provenance attestation, and registry source. 3. Prefer a project-local, lockfile-backed installation over global installation: ```bash npm install --save-exact open-agreements@ ``` 4. Commit and review `package-lock.json`, and use `npm ci` to reproduce the approved dependency graph. 5. Configure npm to use the official registry explicitly and use package provenance verification where supported. 6. Review transitive dependencies and rerun security checks before updating the pinned version. 7. Execute the CLI as an unprivileged user and document that users must not install it with `sudo` or an administrator shell. 8. Consider distributing signed, reproducible artifacts with published checksums instead of directing users to install a mutable latest release. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · template-filling-execution.md (reported line 58)May include surrounding context.
If Local CLI: Write values to a per-run temporary JSON file with restrictive permissions:

bash
VALUES_FILE="$(mktemp /tmp/oa-values.XXXXXX.json)" chmod 600 "$VALUES_FILE" trap 'rm -f "$VALUES_FILE"' EXIT cat > "$VALUES_FILE" << 'FIELDS'

Static analysis

No suspicious patterns detected.