Security audit

contract-redline-navigator

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local contract-review helper with a small diff script and checklist resource, not a hidden or high-privilege package.

Before installing, treat this as operational contract-review support rather than legal advice. Use it only with drafts you intend to share with your agent, confirm the exact old and new files before running the helper script, and review any generated negotiation checklist with qualified counsel for important agreements.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code only performs a generic line-by-line file comparison using Python's difflib and outputs the result as a Markdown-formatted diff. While this partially aligns with the narrow idea of comparing documents, it does not implement the core declared functionality: assessing clause risk, highlighting risky changes specifically, or generating a negotiation checklist with plain-language explanations. There are no undeclared sensitive capabilities, but the primary purpose is materially narrower than the description claims.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The listed triggers `找风险条款` and `做谈判清单` are broad task phrases without clear contractual scope constraints. In a README trigger section, this ambiguity could cause unintended invocation for general risk-review or checklist-generation requests outside the intended contract redlining context.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The skill lists Chinese trigger phrases alongside English ones, and repeats them in suggested prompts, but nowhere states that language selection is optional or user-driven. Under the policy, forcing or assuming a specific language/locale without opt-in is a natural-language policy concern.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrases are very broad and map closely to ordinary contract-review requests, so the skill may activate in situations where a user did not clearly intend to invoke this specialized workflow. That can cause unintended handling of sensitive legal documents, over-application of the skill's framing, or interference with more appropriate general-purpose assistance or policy controls.

Natural-Language Policy Violations

Low

Confidence: 77% confidence
Finding: The skill documentation presents core sections in Chinese while some triggers and input/output guidance are in English, but it does not state whether users may choose their preferred language. This can amount to an implicit language policy without opt-in, especially for users expecting a single supported locale or explicit bilingual support.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: This markdown file uses Chinese throughout its operational and evaluative content, but it does not state that the language is optional or limited to a specific audience. Under the language/locale policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: This markdown file uses Chinese for the objective, checks, and pass criteria, which can impose a language requirement on users or auditors without any stated opt-in or locale justification. The policy allows locale-specific constraints only when documented and justified, which is not present here.

Static analysis

No suspicious patterns detected.