contract audit

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:20 AM UTC
• Version: 1.0.0

Overview

This is a real contract-auditing connector, but it sends contracts and an API key to dyinsight.cn and encourages local plaintext API-key storage without enough privacy or secret-handling guidance.

Install only if you are comfortable sending the target contracts or public URLs to dyinsight.cn and are authorized to share that material. Avoid using highly sensitive or unredacted contracts unless your organization has approved the service's privacy, retention, and billing terms. Do not commit or share config.json after adding a real API key; prefer an environment variable or secret manager, and rotate the key if it was exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: config.json:1

Finding

Plaintext API Credential Storage in Project Configuration

Content

View full analysis

Vulnerability Details

File Location: config.json:1-3; supporting instructions in README.md:9-15 and SKILL.md:97-98
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code

json

{
  "api_key": "YOUR_API_KEY_HERE"
}

The current value is only a placeholder and is not an exposed working credential. However, the accompanying documentation explicitly directs users to replace it with a real API key and retain that key in this plaintext project file.

Technical Analysis

API keys are bearer credentials: possession is generally sufficient to authenticate requests. Storing a real key in a plaintext file inside the project directory makes it accessible to every process, user, agent, backup system, or repository operation that can read that directory.

The project contains no .gitignore entry, environment-variable integration, secret-store integration, or file-permission control protecting config.json. Consequently, after a user follows the documented setup procedure, the credential could be exposed through accidental source-control commits, shared workspaces, archived project copies, diagnostic bundles, logs that capture file contents, or unrelated tools with workspace read access.

The Skill is designed to transmit the configured key to https://dyinsight.cn/api/v1/skills/contract/audit. That transmission is declared and uses HTTPS; the finding concerns local plaintext persistence rather than an undisclosed network destination.

Attack Path

1. A user replaces YOUR_API_KEY_HERE in config.json with a valid API key as directed by the documentation.
2. The project directory is committed to source control, shared with another party, backed up insecurely, or accessed by another local tool or agent.
3. An attacker obtains read access to config.json and extracts the bearer credential.
4. The attacker submits requests to the documented contract-audit AP ...[truncated 746 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove support for storing real API keys directly in the project-tracked config.json.
2. Load the credential from an environment variable such as DYINSIGHT_API_KEY, or use an operating-system or platform-managed secret store.
3. Keep only a non-sensitive example file, such as config.example.json, containing the placeholder value.
4. Add the real local configuration file to .gitignore and equivalent packaging or backup exclusion rules.
5. Apply restrictive filesystem permissions if a local secret file remains necessary, allowing access only to the account running the Skill.
6. Ensure errors and diagnostic logs redact the key and never print request bodies containing it.
7. Update README.md and SKILL.md to describe secure secret provisioning rather than instructing users to place a real key in a project file.
8. Provide key revocation and rotation guidance. Any key previously committed, shared, or archived should be treated as compromised and replaced.
9. Where supported by the service, issue narrowly scoped keys with rate limits, spending limits, expiration, and monitoring for anomalous use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The README is entirely written as mandatory Chinese usage guidance and directs users to a WeChat mini program, but it does not state that the skill is region-specific or provide any language/locale opt-in. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README instructs users to upload contract files or submit public URLs to an external audit API but does not disclose that sensitive legal documents will leave the local environment and be transmitted to a third-party service. Contracts commonly contain confidential business, personal, and financial data, so missing disclosure and consent guidance increases the risk of unintended data exposure and improper handling of sensitive information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to send contract URLs/files and an API key to an external production endpoint, but it does not prominently warn about third-party data transmission or the privacy/sensitivity implications. Because contracts often contain confidential business or personal information, omission of a clear disclosure can lead to unintended exfiltration of sensitive data to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This skill is explicitly designed to POST contract content or URLs plus an API key to an external domain, which is a real external transmission path rather than a hypothetical one. In this context, the danger is not that external access is unexpected from the functionality, but that sensitive legal documents and credentials are sent off-box to a production service, increasing confidentiality and credential exposure risk if users are not adequately informed or if the endpoint is not appropriately governed.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

JSON（链接）

bash

curl -N -s -X POST "https://dyinsight.cn/api/v1/skills/contract/audit" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "YOUR_API_KEY",

Static analysis

No suspicious patterns detected.