Security audit

AI合同智能审查助手

Security checks for vulnerabilities and agentic risk

Overview

This contract-review skill is mostly purpose-aligned, but it handles sensitive legal documents while claiming offline use and still enabling network paths that are not clearly disclosed.

Install only if you are comfortable with a skill that may process sensitive contract text, create local report files, and potentially use network access despite offline wording. For confidential contracts, use explicit prompts, avoid URL-based inputs, and consider blocking the report’s CDN request or replacing Chart.js with a local copy.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill claims to be fully local and offline, but later instructs handling contracts from a URL and permits `WebFetch`/`WebSearch`. For a contract-review skill that processes highly sensitive legal documents, this inconsistency can mislead users into exposing confidential contract contents or metadata to network-accessible workflows they did not intend to use.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The template fetches Chart.js from a public CDN at report render time, which creates unnecessary outbound network access for a local contract-review report and exposes contract-review sessions to third parties via requests, IP metadata, and possible referer leakage. It also introduces supply-chain risk: if the CDN asset is modified, unavailable, or blocked, the generated report may execute untrusted code or fail to render properly.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger phrases are broad, natural-language requests like '帮我看看合同' and '合同审核', which can match ordinary user intent outside a narrowly scoped invocation. This increases the chance of accidental activation, unintended processing of sensitive contract data, and user confusion about which skill is handling the request.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases are broad and map to ordinary conversation about contracts, which can cause the skill to activate in contexts where the user did not explicitly request this workflow. In a skill with file parsing, web access, Bash execution, and report generation, overbroad activation increases the chance of unintended processing of sensitive legal material.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: Treating any uploaded or pasted contract text as an automatic trigger is risky because users may share a document for translation, summarization, or storage rather than full legal-risk analysis and local report generation. Given the sensitivity of contracts and the toolset available, ambiguous activation can lead to unnecessary extraction, persistence, and possible network-assisted handling of confidential information.

Static analysis

No suspicious patterns detected.