Legal Matter Intake Summarizer

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

This skill is a Chinese-language legal intake summarizer with a local helper script; the reviewed package does not show hidden execution, persistence, network use, or credential theft.

Install this only if you want a Chinese-language legal intake drafting aid. Treat its output as an organizational draft, not legal advice, and avoid feeding it sensitive case materials unless the local workspace and chosen output path are appropriate.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 声明描述的是一个法律咨询材料整理器，输出应聚焦事实、争议点、缺失材料和后续问题，且避免法律结论。但实际代码并没有任何法律领域专属逻辑。它从 resources/spec.json 读取配置，根据 mode 执行多种通用审计/扫描任务：structured_brief 只是把输入文本按行切分后分配到若干章节；directory_audit 会递归扫描目录与文件类型；csv_audit 会读取表格并统计字段非空/唯一值；pattern_audit 会扫描诸如 curl|bash、rm -rf、secret/token 等风险模式；skill_audit 会检查一个 Skill 目录是否包含指定文件并验证 SKILL.md frontmatter。虽然 structured_brief 模式可被配置成类似“事实/争议点/缺失材料/后续问题”的章节，但代码本质能力远超且偏离法律 intake，总体主用途是通用内容/仓库审计与报告生成。因此描述未准确代表代码实际行为，属于明显不匹配。

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The built-in regex scanner searches arbitrary files for secrets, internal URLs, and dangerous command patterns, then emits snippets from matched content into the report. For a legal intake summarizer, this is unjustified capability creep and can expose sensitive credentials or private repository content through tool output, even if partially masked.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The dispatcher enables multiple operational modes such as directory auditing, CSV auditing, pattern scanning, and skill auditing that go well beyond the declared purpose of a legal matter intake summarizer. In this context, that scope expansion lets the skill inspect arbitrary local files and directories, creating an unnecessary data-access surface and increasing the chance of sensitive workspace information being enumerated or summarized.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: This markdown file presents all user-facing content exclusively in Chinese, including the title and audit conclusions. Under the language/locale policy, forcing a specific language without user opt-in or documented justification can be a natural-language policy violation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises shell, file read, and file write capabilities via its instructions, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent may infer it is permitted to perform broader local actions than the metadata communicates, reducing auditability and increasing the chance of unintended file access or command execution.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The manifest description and core skill description are written as mandatory Chinese-language instructions, with no indication that the user may choose another language. This creates a language/locale policy concern because the skill appears to enforce a specific language rather than offering output in the user's preferred language.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The example output is entirely written in Chinese, including the title and all section headings, with no indication that the user can choose another language or locale. Under the language/locale policy rule, a skill should not implicitly force a specific language unless it is clearly justified or offered as an opt-in choice.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The template includes a '风险提示' section even though the skill is described as only organizing intake facts and not providing legal conclusions. In a legal-intake context, asking the model to generate risk warnings can drift into legal assessment or advisory content, which may exceed the skill’s declared scope and create unauthorized or misleading legal guidance.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: This code generates user-facing report headings and guidance exclusively in Chinese, such as "结果", "摘要", and workflow instructions. That imposes a specific language on users without offering a choice or documenting a justified locale constraint, which matches the language/locale policy concern.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The directory reporting logic recursively walks directories, samples many files, reads Markdown contents, and summarizes repository structure. In a legal-intake skill, this broad filesystem auditing is unrelated to the stated business purpose and can unintentionally disclose confidential case materials, notes, or other local project data to the report consumer.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The markdown content, including the title and all test instructions, is presented only in Chinese. Under the policy rules, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Vague Triggers

Low

• Confidence: 79% confidence
• Finding: The README provides example trigger phrases such as '列出还缺哪些材料', which could overlap with ordinary requests outside this specific skill context. It does not define explicit activation boundaries or negative examples clarifying when the skill should not be invoked.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The template title and all section headers are written exclusively in Chinese, which indicates the skill output is constrained to a specific language. The file does not offer a user language choice or explain that the skill is intentionally limited to a Chinese-speaking legal context.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The manifest says the skill should organize facts, dispute points, missing materials, and follow-up questions, and explicitly says not to provide legal opinion conclusions. This test file defines successful output as including '风险提示', which implies a risk-assessment capability beyond the stated intake-only summarization scope.

Static analysis

No suspicious patterns detected.