docusign-skill
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exposes a vulnerability surface through its bulk-send functionality, which processes a JSON specification file containing recipients and document paths. If an agent is directed to use an attacker-controlled configuration file, it could be manipulated into sending unauthorized envelopes or emails.\n
- Ingestion points: docusign_skill.py processes JSON data from a local file path provided to the bulk-send command.\n
- Boundary markers: There are no explicit instructions or delimiters used to separate the external configuration data from the agent's instructions in SKILL.md.\n
- Capability inventory: The skill can send documents to third-party emails, download signed documents, and list account status via the DocuSign API.\n
- Sanitization: The input JSON is parsed into objects but no validation is performed on the trustworthiness of the recipients or documents specified in the list.\n- [DATA_EXFILTRATION]: The skill is designed to read a sensitive RSA private key from the local path ~/.claude/skills/docusign-skill/private.key for JWT signing and stores access tokens in local JSON files. It also includes production environment identifiers (User ID and API Account ID) in PROD_IDS.md. While these are necessary for the skill's documented authentication flow and operations, they represent an exposure surface for high-value credentials and environment metadata.\n- [COMMAND_EXECUTION]: The skill relies on executing the docusign_skill.py script via the Bash tool to perform all operations, including account setup, consent management, and document delivery. While the script itself performs legitimate tasks, this provides the agent with the capability to perform high-impact network and file operations.
Audit Metadata