法律 Harness 初始化

• Outcome: Review
• Latest audit: Aug 12, 2026 · 12:26 PM UTC
• Version: 0.3.0

Overview

The skill is mostly coherent and disclosed, but it changes persistent agent instruction files and its advertised restore path failed in local Linux testing, so it should be reviewed before installation.

Before installing, treat this as a tool that can change future agent behavior across projects. Use --dry-run, inspect every diff, avoid putting real case facts or credentials into AGENTS.md/CLAUDE.md, and verify backup/restore on your operating system before relying on it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to read local files and execute shell scripts (`detect.sh`, `validate-content.sh`, `write.sh`, `restore.sh`, `verify.sh`, `test.sh`) but does not declare permissions for those capabilities. This creates a governance gap: a harness may permit actions users or reviewers did not expect, especially because the skill can modify AGENTS.md/CLAUDE.md and related local files.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill is intended for AGENTS.md/CLAUDE.md governance and legal safety baseline setup, but the embedded config writes a concrete case number into managed configuration content. This creates unnecessary exposure of matter-specific sensitive data in a reusable harness artifact, increasing the risk of confidentiality leakage, cross-project propagation, and accidental retention in version control or shared team instructions.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The recorded precedence order places "legal_safety" after individual, project, and organization layers, which conflicts with the stated purpose of enforcing a minimum legal safety baseline during merge/initialization. If downstream logic applies precedence in listed order or gives later entries lower authority, user/project instructions could override mandatory confidentiality, privilege, or retention safeguards, weakening the legal harness in a context where safety controls are expected to be authoritative.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The file records "CONFIG_WRITTEN" while session evidence shows new_session=false and loaded=false, implying initialization or validation succeeded without the expected session conditions being met. In a legal workflow, this can create a false assurance that safeguards were installed or verified, causing operators to proceed without confirming permissions, confidentiality posture, or evidence of actual baseline loading.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The file embeds substantive legal-practice templates such as complaint forms, legal opinions, due diligence reports, and contract review structures, which exceed the declared purpose of initializing or governing AGENTS.md/CLAUDE.md. In this context, the skill can steer an agent from safe harness configuration into producing regulated legal-work-product scaffolds, increasing the chance of unauthorized legal assistance and accidental insertion of sensitive or inappropriate content into governance files.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The skill implements concrete legal-document and workflow-template capability that is materially broader than its stated harness-governance function. This scope mismatch is dangerous because users or downstream agents may rely on the skill as an approved path to generate legal drafting structures under the cover of a configuration task, bypassing intended product boundaries and safety review.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The file tells the agent to proactively use this snippet library and later write an M2 section into AGENTS.md, while the library contains content unsuitable for a governance file. This creates a pathway for contamination of project instructions with legal-practice templates, which can persist across sessions and alter future agent behavior in unintended ways.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The file instructs the agent to 'directly generate and write' AGENTS.md across detected locations without an explicit confirmation or warning that files will be modified. In a skill that manages governance files and may target multiple scopes (user/project/team), implicit writes increase the risk of unintended filesystem changes, overwriting existing instructions, or modifying more locations than the user expects.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill directs the agent to write into AGENTS.md without requiring explicit user confirmation that a repository or project file will be changed. Even if the intended content were safe, silent or implied file modification is risky because it can persist unexpected instructions, create audit issues, and surprise users in legal or confidential environments.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The instruction that the agent should 'proactively' consult this snippet library whenever the user is 'stuck' is vague and not operationally bounded. In a legal-harness initialization skill, ambiguous activation conditions can cause the agent to inject collaboration-style guidance outside the user's explicit request, creating scope drift and increasing the chance of inappropriate modifications to AGENTS.md or related governance content.

Vague Triggers

Low

• Confidence: 80% confidence
• Finding: The examples of when to reference the snippets appear illustrative rather than exhaustive, so the trigger boundary remains subjective. That ambiguity is mildly risky because an agent may over-apply the module in adjacent legal tasks, leading to unintended guidance or policy text generation in contexts where the style library should not control behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.