Security audit

法律 Harness 初始化

Security checks for vulnerabilities and agentic risk

Overview

This is a transparent legal-workflow setup skill for persistent agent instruction files, with a real verification caveat users should not treat as tamper-proof.

Install only if you intend to let the skill create or update persistent AGENTS.md/CLAUDE.md rules for legal work. Review the dry-run diff and target paths before writing, keep real client facts and credentials out of persistent config, and treat BEHAVIOR_VERIFIED as an operator-managed fresh-session check rather than a tamper-proof security attestation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/verify.sh:92
Finding: Unsigned Session Evidence Can Falsely Produce BEHAVIOR_VERIFIED Status
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (66)

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · CHANGELOG.md (reported line 55)May include surrounding context.
md
## [0.2.0] - 2026-08-12 > 参考 self-evolve `detect_platforms()` 风格，补齐"检测当前 runtime + 自动写入对应位置"能力。端到端真实跑通仍 NOT_VERIFIED。 ### 变更

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: This second mismatch finding indicates the underlying implementation may mainly perform backup/restore rather than the promised governance, layering, baseline generation, and verification workflow. Such overstatement is dangerous because operators may rely on nonexistent safety controls, incorrectly believing legal safety baselines or verification probes were actually applied.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This second mismatch finding indicates the underlying implementation may mainly perform backup/restore rather than the promised governance, layering, baseline generation, and verification workflow. Such overstatement is dangerous because operators may rely on nonexistent safety controls, incorrectly believing legal safety baselines or verification probes were actually applied.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
md
2. `INSTRUCTIONS_LOADED`：新会话报告了精确加载来源。 3. `BEHAVIOR_VERIFIED`：新会话通过四类行为探针。  如果无法启动新会话，必须报告 `CONFIG_WRITTEN` + `NOT_VERIFIED`，不得声称配置已经生效。 ## 适用边界

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
md
2. `INSTRUCTIONS_LOADED`:新会话报告了精确加载来源。 3. `BEHAVIOR_VERIFIED`:新会话通过四类行为探针。  如果无法启动新会话,必须报告 `CONFIG_WRITTEN` + `NOT_VERIFIED`,不得声称配置已经生效。 ## 适用边界

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
md
- 交付物版本和用户可见变化 → `CHANGELOG.md` 或项目指定交付记录。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.
md
`write.sh` 必须自动添加形如 `` 的唯一成对 marker，并按实际目标路径去重；内容临时文件不得自行添加外层 marker。先运行内容校验，再用 `--dry-run` 展示合并候选 diff。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.
md
`write.sh` 必须自动添加形如 `` 的唯一成对 marker，并按实际目标路径去重；内容临时文件不得自行添加外层 marker。先运行内容校验，再用 `--dry-run` 展示合并候选 diff。

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/15-sync-with-project-init.md (reported line 13)May include surrounding context.
md
|---|---|---| | 用户级 `AGENTS.md`（`~/.claude/CLAUDE.md` 等） | ❌ 不做 | ✅ 做（法律人设 + 回溯契约 + 工作偏好） | | 项目级 `AGENTS.md`（`<项目>/AGENTS.md`） | ✅ 做（生成项目协议 + docs 体系） | ✅ 做（用受管区块叠加法律安全、回溯和受控上下文规则） | | 项目脚手架（`.claude/.codex/settings/skills/.gitignore`） | ✅ 做 | ❌ 不做 | | 检测项目类型 | ✅ | ❌（按用户告知/手动选） | | 安装 skills | ✅ | ❌ | | 生成项目所需文档体系 | ✅（按项目规则） | ❌ |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file’s headings and explanatory text are entirely in Chinese, which indicates a language-specific presentation. Under the policy rule, a forced language without user opt-in or a documented justification can be a natural-language policy violation, and this file does not state that the skill is China-only or otherwise justify the locale constraint.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · CHANGELOG.md (reported line 71)May include surrounding context.
md
### 决策 - DEC-009：平台权威表抽 `lib_platforms.sh` 单一真值源（避免 detect/write 路径漂移） - DEC-010：只对 `claude_md` / `agents_md` 平台自动写入；`non-agents-md` 平台（QoderWork/QwenWork/WorkBuddy/Orca）仅检测提示手动 ### 验证

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · CHANGELOG.md (reported line 71)May include surrounding context.
md
### 决策 - DEC-009:平台权威表抽 `lib_platforms.sh` 单一真值源(避免 detect/write 路径漂移) - DEC-010:只对 `claude_md` / `agents_md` 平台自动写入;`non-agents-md` 平台(QoderWork/QwenWork/WorkBuddy/Orca)仅检测提示手动 ### 验证

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to run shell commands and read local files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an undeclared capability boundary: a reviewer or platform may underestimate that the skill can inspect the filesystem and modify harness-related files, which is especially sensitive in a legal context handling confidential material.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire skill file is written in Chinese and does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-language or region-specific workflow. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The embedded natural-language content in config_text specifies the project heading as 项目, which imposes Chinese-language output/content without any visible opt-in or justification. This matches the policy concern for language or locale constraints that are forced rather than user-selectable.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The artifact asserts "BEHAVIOR_VERIFIED" while the embedded session evidence explicitly shows no new-session validation and no loaded validation occurred. In a legal safety baseline skill, this can mislead downstream users or automation into trusting confidentiality, permission, and harness checks that were never actually performed, weakening governance controls.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The generated baseline content embeds a specific case identifier, which exceeds a minimal legal safety baseline and introduces unnecessary sensitive matter metadata into a shared harness configuration file. In a legal workflow, even a docket/case number can enable matter linkage, accidental disclosure, cross-project propagation, or downstream indexing in repositories and agent context.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file records CONFIG_WRITTEN while session_evidence shows the configuration was neither loaded nor validated in a new session, meaning the skill may falsely assert completion of a safety-critical initialization step. In this skill's context, that can cause users to rely on legal/privacy guardrails that were never actually enforced, increasing the risk of unauthorized behavior, missed confidentiality checks, and unsafe agent operation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language content in config_text includes the Chinese phrase 项目：LIT-YYYY-001, which imposes a specific language in the generated/project-facing content. There is no indication in this file that the user can choose the language or that the locale restriction is required for a region-specific purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire skill content is written in Chinese and presents itself as general guidance about AGENTS.md usage, but it does not indicate that the language choice is optional or limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file presents all operational guidance in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document instructs the agent to directly generate and write AGENTS.md after collecting answers, but it does not require an explicit confirmation step or warn the user before modifying files. In a tool that governs agent behavior and legal-safety rules, silent or assumed file writes can cause unintended configuration changes, overwrite existing instructions, or commit unsafe policy text into the workspace.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The text states that the user's practice region determines the agent's default legal domain, language, and conventions. This imposes a language/locale choice automatically rather than offering the user an explicit opt-in or override, which matches the policy-violation category for forced language or locale behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This line says the agent should default to '上海法院管辖 / 民商事诉讼惯例' when it reads the profile. That is a natural-language locale/jurisdiction policy constraint applied automatically, without indicating user choice or confirmation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Line L143 states that Chinese is the default because most Chinese legal professionals choose it. This presents a default locale choice rather than preserving neutral user selection, and the surrounding examples repeatedly reinforce Chinese as the expected default.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.