Security audit

Contract Risk Review Assistant

Security checks across malware telemetry and agentic risk

Overview

This is a self-contained construction contract review checklist with no executable code, but users should redact sensitive contract details before using it.

Use this as an advisory checklist, not a substitute for licensed legal advice. Before pasting or uploading a contract, remove sensitive personal data, bank details, seals, signatures, private pricing, and trade secrets unless those details are necessary for the review.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list uses broad, common contract-related phrases such as '合同审查' and '合同审核', which can cause the skill to activate in contexts where the user did not intend to invoke this specialized workflow. Unintended activation can expose users to irrelevant legal-style guidance and may prompt them to share sensitive contract content unnecessarily, increasing privacy and workflow risks.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill explicitly asks users to paste or upload contract text but provides no warning about confidentiality, personal data, trade secrets, or privileged legal material. Because contracts commonly contain sensitive commercial and personal information, this omission can lead users to disclose protected data into the system without informed consent or minimization safeguards.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.