Security audit

AI合同智能审查助手

Security checks for vulnerabilities and agentic risk

Overview

This contract review skill is not clearly malicious, but it needs Review because it handles sensitive contracts with broad tool access and generates HTML reports that can run injected or remote JavaScript.

Use this only in a constrained workspace with contracts you trust, and treat it as a Chinese/PRC-law assistant rather than general legal advice. Before installing broadly, narrow the tool permissions, disable or explicitly confirm network access, vendor or integrity-pin Chart.js, sanitize all report fields, and avoid opening generated HTML from adversarial or third-party contracts until the template is fixed.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: assets/report_template.html:281
Finding: Stored HTML and JavaScript Injection in Generated Contract Reports
Content: View full analysis
`

${ki.label}

${ki.value}

`).join(''); ``` Risk data is also rendered without escaping: ```javascript const html = filtered.map(r => `

${levelNames[r.level] || r.level} ${r.title || '未命名风险'} ${r.dimension ? '' + r.dimension + '' : ''}

${r.description || ''}
${r.original ? '
📌 原文：' + r.original + '
' : ''} ${r.suggestion ? '
✅ 建议：' + r.suggestion + '
' : ''} ${r.law_ref ? '
⚖️ ' + r.law_ref + '
' : ''}
`).join(''); document.getElementById('riskItemsContainer').innerHTML = htm ...[truncated 2495 chars]
Remediation: View remediation
`, `&`, U+2028, and U+2029. 4. Prefer placing serialized data in a non-executable ``, ``, `javascript:` URLs, SVG event handlers, and malformed HTML. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

Location: assets/report_template.html:7
Finding: Remote JavaScript Execution Through an Unverified CDN Dependency
Content: View full analysis
``` ### Technical Analysis Every generated report loads and executes JavaScript from a third-party CDN. Although a package version is specified, the resource has no Subresource Integrity hash and the document has no restrictive Content Security Policy. Consequently, the effective JavaScript executed by the report is not entirely contained in the audited project. A compromised CDN response, package artifact, DNS path, TLS trust path, or upstream account could deliver code different from the reviewed dependency. This behavior also contradicts the project's stated local and offline operation because opening a report generates an external request and requires remote content for the radar chart. ### Attack Path 1. The user generates a report containing confidential contract information. 2. The user opens the HTML report in a browser while network access is available. 3. The browser requests Chart.js from `cdn.jsdelivr.net`. 4. An attacker who compromises the upstream package, CDN artifact, or delivery path supplies modified JavaScript. 5. The browser executes the modified response in the report document. 6. The remote code reads or alters report content and can attempt to transmit it to an external endpoint. ### Impact Assessment Successful exploitation gives the remote payload JavaScript-level access to the report document. It may: - Read contract parties, amounts, dates, clauses, risks, and negotiation recommendations. - Modify or conceal report findings. - Introduce phishing content or deceptive links. - Initiate outbound browser requests. - Cause the report to fail when the CDN is unavailable. The execution is limited to the browser con ...[truncated 76 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/parse_contract.py:18
Finding: Unpinned Runtime Dependency Installation Guidance
Content: View full analysis
str: """Extract text from .docx file using python-docx.""" try: from docx import Document except ImportError: sys.exit("ERROR: python-docx not installed. Run: pip install python-docx") ``` ```python def extract_pdf(filepath: str) -> str: """Extract text from .pdf file.""" try: import pdfplumber except ImportError: try: from PyPDF2 import PdfReader except ImportError: sys.exit("ERROR: Need pdfplumber or PyPDF2. Run: pip install pdfplumber") ``` ### Technical Analysis The script instructs users to install dependencies without version constraints, hashes, a lock file, or a documented trusted package index. The installed code therefore depends on the latest version resolved by the user's current package-index configuration. Python packages can execute code during installation and are imported into the contract parser at runtime. A compromised release, malicious configured mirror, or future incompatible release would become part of the local execution path without having been reviewed with this project. No evidence shows that the named packages are currently malicious. The issue is the unsafe and non-reproducible acquisition process. ### Attack Path 1. A user runs the parser without the required library installed. 2. The script emits an installation command such as `pip install python-docx`. 3. The user follows the instruction in an environment configured to use the default index or an untrusted mirror. 4. Pip resolves an unconstrained package release. 5. Package installation code executes, and the installed package is subsequently imported by the parser. 6. If the selected artifact is compromised, its code runs with the privilege ...[truncated 572 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:4
Finding: Skill Tool Permissions Exceed the Documented Contract-Review Workflow
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied code implements only a narrow subset of the declared functionality: key information extraction, clause structuring, and summary generation. It does not perform substantive contract risk review, scoring, visualization, legal citation, negotiation strategy generation, clause comparison/edit suggestions, or HTML report generation. The primary behavior is a regex-based extraction utility, not a full AI contract intelligent review assistant. While some declared items are partially supported (关键信息提取、合同摘要、条款结构化解析), the description materially overstates the implemented capabilities, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个完整的AI合同审查系统，核心价值在于法律/风险分析与可视化报告生成；但提供的代码仅完成文件读取、文本提取和简单的基于关键词的合同类型识别，没有任何审查、分析、评分、可视化、建议生成、摘要生成、法律依据检索或HTML报告生成逻辑。代码也没有体现触发词相关处理。虽然‘合同类型识别’与声明中的覆盖合同类型有弱相关性，但仅属非常有限的辅助步骤，无法支撑所宣称的主要功能，因此属于明显的描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The README presents the skill as a Chinese-language contract review assistant and all user-facing invocation guidance is in Chinese, but it does not explicitly offer a language choice or state that the tool is intentionally limited to Chinese-language legal contexts. This can violate language/locale policy when a skill implicitly mandates one language without opt-in or justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documented trigger phrases are broad, generic requests such as '合同审查', '合同分析', and '帮我看看合同', which are likely to match ordinary user conversations about contracts rather than an explicit intent to invoke this specific skill. In an agent environment, that can cause over-triggering, unintended activation, and accidental processing of sensitive legal documents or requests by this skill when the user may have intended a different tool or a general discussion.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: L003 的触发词列表包含“帮我看看合同”，该表达接近日常自然请求，缺少更明确的上下文限制或排除条件。文档虽列出若干关键词，但未说明哪些场景不应触发，因此容易与普通对话中的求助表达重叠。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill claims to be 'fully local/offline' while declaring WebSearch/WebFetch tools and accepting URL-based contract retrieval. For a contract-review workflow, this increases the chance that highly sensitive contract contents or URLs are fetched over the network contrary to user expectations, creating confidentiality and trust risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill processes contracts and generates a local HTML report file that may contain the full contract text, extracted key fields, risk annotations, and negotiation suggestions, but the description does not clearly warn users about this local artifact. In a legal-document context, silent creation of derivative files can expose confidential business terms or personal data to other local users, backups, sync tools, or later unintended sharing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML document hard-codes lang="zh-CN", indicating the report is intended to render in Simplified Chinese only. Under the stated policy, forcing a specific language/locale without user opt-in is a natural-language policy violation unless the constraint is explicitly justified, which is not documented here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Most visible report labels, headings, and disclaimers are presented in Chinese, and date/time formatting later also uses the zh-CN locale. The file does not indicate that users can choose another language or that Chinese-only output is a justified regional requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file presents all user-facing checklist content in Chinese, and there is no indication that users can choose another language or that the Chinese-only format is a justified region-specific requirement. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file is written primarily in Chinese and presents the methodology as the default without any indication that users may choose another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language strings that require Chinese for usage and output, which can violate language/locale policy when no user opt-in or justification is provided. The same pattern continues in argument descriptions and runtime messages, indicating the skill assumes a fixed language rather than allowing user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file is entirely presented in Chinese and does not indicate that the user can choose another language or that the checklist is intentionally limited to a Chinese-speaking or China-specific audience. Under the natural-language policy rules, forcing a specific language without opt-in can be a locale-policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: 该清单全文以中文呈现，未见任何说明用户可选择其他语言，亦未说明这是仅面向特定中文法域或用户群的限定版本。根据规则，强制特定语言且无用户选择/明确正当化，属于自然语言层面的语言/地区政策风险。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire checklist is written in Chinese and provides no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or China-specific audience. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file presents all user-facing checklist content in Chinese and does not indicate that the language is optional, selectable, or limited to a specific regional/legal audience. Under the natural-language policy rule, forcing a specific language without user opt-in can be a policy violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file contains user-facing natural language only in Chinese, which can be interpreted as enforcing a specific language without an explicit opt-in or documented region-specific justification. The policy allows locale constraints when they are clearly justified, but this file provides no such explanation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file contains user-facing natural language content exclusively in Chinese, and there is no indication that users can choose another language or that the locale restriction is explicitly documented. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all skill content in a single forced language, which can constitute a language/locale policy issue when no user choice or opt-in is provided. There is no indication that the skill is region-specific or that Chinese-only content is a justified constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The document title and description are entirely in Chinese and present the content as a general-purpose law reference library, but they do not indicate that the skill is intentionally limited to Chinese-language users or China-specific legal workflows. Under the policy rule for language/locale constraints, this is a natural-language locale restriction without explicit user opt-in or justification in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language strings that force a specific language/locale for usage instructions and interaction. Under the policy, language constraints should either offer user opt-in/choice or be clearly documented as a justified region-specific tool, which is not present here.
Content: No source excerpt is available for this finding.