Is skills/signature-request safe?
https://github.com/anthropics/knowledge-work-plugins/tree/main/legal/skills/signature-request
The signature-request skill is a clean, documentation-only skill containing a structured legal workflow for e-signature routing. No prompt injection, executable code, malicious file access, or canary exfiltration was detected. The only risks are inherent to the skill's legitimate purpose: it processes confidential contract documents and collects signer PII, and it enables the agent to dispatch binding legal documents — users should review the pre-signature checklist output carefully before confirming any send action.
Category Scores
Findings (5)
LOW Skill handles sensitive contract documents and signer PII -8 ▶
The skill's workflow instructs the agent to read document contents, extract party names, and collect signer email addresses. While this is operationally necessary, it means the agent's context will contain confidential legal documents and contact information during execution. Users should ensure their agent does not log or cache conversation context insecurely.
LOW E-signature routing carries inherent authorization risk -12 ▶
The skill enables the agent to dispatch binding legal documents for electronic signature. A user who invokes this skill by reference ('the Acme Corp MSA we finalized yesterday') without reviewing the output could inadvertently send a document with incorrect signers or to wrong recipients. The skill includes a checklist but relies on the agent to populate it correctly.
INFO Canary files read during monitoring window 0 ▶
Filesystem monitoring recorded access to .env, id_rsa, .aws/credentials, .npmrc, .docker/config.json, and gcloud credentials at 18:49:33 (5 seconds before install) and 18:49:45 (6 seconds after install). Timeline analysis and process audit trail indicate these reads are attributable to the audit framework's pre/post canary integrity checks, not to the skill or its install procedure. Canary integrity confirms no modification or exfiltration.
INFO Argument expansion via @$1 is standard but worth noting -5 ▶
The skill uses '@$1' to incorporate the user-supplied argument. This is the standard argument-passing convention for this skill ecosystem and poses no injection risk, but downstream content from the argument (e.g. a document filename or reference) is passed into the agent's context unescaped.
INFO No executable components present 0 ▶
The skill directory contains only SKILL.md. No package.json, no scripts, no git hooks, no submodules, no symlinks. The install process is handled entirely by the audit framework's sparse-checkout mechanism.