ClawHub
Back to skill

Security audit

remember-legal-research

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for legal research memory, but it sends and persists sensitive legal work to an external service without enough privacy, retention, or redaction guidance.

Install only if you are authorized to send legal research content to BlueColumn/Supabase. Avoid client names, matter identifiers, privileged strategy, sealed facts, and other confidential details unless your organization has approved the vendor, retention policy, deletion process, and API key handling.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs agents to send legal research content, including questions, authorities, and reasoning, to a third-party API without any warning about remote persistence, confidentiality, or data handling. In a legal context, research threads can contain privileged strategy, client facts, or sensitive matter details, so undisclosed external transmission creates a real privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This example demonstrates direct external transmission of legal research content to a Supabase-hosted endpoint using a live API key, which confirms that substantive research text leaves the local environment. While the feature appears intended functionality rather than overtly malicious behavior, in this skill context the transmitted material may include confidential legal analysis and therefore presents a meaningful confidentiality risk if users are not warned or if the service is not appropriately governed.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Store each finding with the question it answers, the source, and the citation. Cite like a lawyer: name, reporter, pin.

bash
curl -X POST https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1/agent-remember \
  -H "Authorization: Bearer $BLUECOLUMN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text": "RESEARCH: Is a clickwrap enforceable in the 9th Cir.? Berman v. Freedom Financial Network, 2019 WL 123456, at *4 — yes, if conspicuous and user had reasonable notice. Distinguish: Nguyen v. Barnes & Noble (hover-over hyperlink insufficient).", "title": "legal - clickwrap 9th Cir"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The recall and note workflow encourages persistence of in-progress legal questions and session context across sessions, but does not disclose that this material is stored remotely. Because open questions and research state can reveal litigation strategy, client interests, or confidential investigative direction, the omission can lead users to unknowingly persist sensitive legal work product to an external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.