App Legal Pages

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:46 AM UTC
• Version: 0.1.6

Overview

The skill mostly does what it claims, but its production-ready examples can publish the wrong contact email and legal jurisdiction if copied unchanged.

Install only if you will replace all sample contact and jurisdiction values, review the generated legal pages line by line, and confirm the exact Cloudflare project before deployment. Do not paste Cloudflare API tokens into prompts; configure credentials in the environment or use Wrangler login.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:56
• Finding: Hardcoded Personal Contact Address Can Redirect Privacy Requests## Vulnerability Details **File Location**: `SKILL.md:56-57`; duplicated in `assets/example-output/privacy.html:37,49` and `assets/example-output/terms.html:38` **Vulnerability Type**: Hardcoded sensitive contact information and unintended data routing **Risk Level**: Medium ### Vulnerable Code ```bash --base-email "[e-mail]" \ --email-tag "quillnest" \ ``` The resulting address is embedded in the example legal pages: ```html <p>You may request access, correction, or deletion of your information by contacting <a href="mailto:[e-mail]">[e-mail]</a>.</p> ``` ```html <p>Email: <a href="mailto:[e-mail]">[e-mail]</a></p> ``` ### Technical Analysis The primary generation example supplies a real-looking personal email address rather than a reserved example address. The generator derives `[e-mail]` from this value, and the same address is already embedded in the distributable example output. Users or automated agents may treat the documented command and example assets as deployment-ready. If copied without modification, the generated Privacy Policy and Terms direct access, correction, deletion, support, and other legally significant requests to that mailbox. Because privacy requests commonly contain identifying information, account details, and descriptions of personal data, this creates an unintended sensitive-data disclosure channel. No mailbox credentials or local system privileges are exposed by the code itself. The vulnerability concerns unauthorized receipt of communications and personal information from visitors to incorrectly configured deployments. ### Attack Path 1. A publisher follows the canonical command in `SKILL.md` or copies files from `assets/example-output`. 2. The publisher fails to replace the hardcoded base email before deploying the legal site. 3. The published ...[truncated 1245 chars]
• Remediation: ## Remediation Suggestions 1. Replace the personal address in `SKILL.md` with a reserved neutral value such as `[e-mail]`. 2. Remove the address from all files under `assets/example-output` and regenerate those assets with clearly fictional contact information. 3. Require the publisher to provide `--email` or `--base-email` explicitly rather than supplying a copyable personal default. 4. Before deployment, validate generated pages and reject known sample addresses, `example.com` addresses, placeholder markers, or contact values not explicitly approved by the publisher. 5. Include the final contact address in the mandatory review summary and require explicit confirmation that it belongs to the deploying entity. 6. Add automated tests that scan documentation and example assets for personal email addresses and prevent publication when one is detected. 7. Regenerate the stale example pages to remove `TODO_LEGAL_REVIEW`, unsupported sharing and international-transfer language, and the hardcoded China governing-law clause so examples cannot be mistaken for reviewed production output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code clearly supports part of the declared description: it generates Privacy Policy and Terms of Service static website files from an app feature document. However, the declared purpose significantly overstates the implementation. There is no code for GitHub interaction, Cloudflare Pages deployment, authentication, network access, repository creation/updates, or publication of URLs. There is also no consistency-checking logic beyond simple keyword heuristics, and no deployment-ready orchestration beyond writing local HTML/CSS files. Therefore the description does not accurately represent the actual behavior of this code chunk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes shell commands, reads/writes files, and checks environment-based Cloudflare authentication, but it declares no explicit tool scope or permissions boundary. That increases the chance an agent can perform filesystem or deployment actions without a clearly constrained authorization model, especially in a skill that can publish content publicly.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

4. Present generated pages for user review/approval.
5. Check Cloudflare deployment auth readiness.
6. Ask user to complete auth if missing.
7. Auto-deploy to Cloudflare Pages after explicit confirmation.
8. Return final public URLs.

## 1) Collect Inputs

• Confidence: 87% confidence
• Finding: The workflow includes automatic deployment after confirmation, meaning the skill can take an external side effect—publishing content to Cloudflare Pages—without a separate execution boundary beyond conversational approval. In a skill that produces legal content, this raises risk of accidental public release of incorrect or incomplete documents if confirmations are ambiguous or if prior steps were wrong.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The skill says it must not assume analytics, tracking, sharing, or permission usage unless explicitly stated, but later instructs use of heuristic auto-detection from feature text. That contradiction can generate inaccurate privacy disclosures, leading to false legal statements or omitted disclosures in public policies, which is especially risky for a legal-document generation skill.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The language rule states that the skill should generate English-only legal pages by default and exclude non-English feature bullets to keep language consistent. This is a locale/language restriction expressed in natural language, and the file does not offer the user an explicit language choice or opt-in.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill handles Cloudflare authentication and public deployment but does not clearly warn that API tokens are sensitive secrets or that publishing makes the legal pages publicly accessible. In a deployment-oriented skill, that omission can lead users to expose credentials in insecure contexts or unintentionally publish inaccurate legal content.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

wrangler login
```

## 7) Auto-Deploy to Cloudflare Pages

After explicit approval + auth ready:

• Confidence: 87% confidence
• Finding: The dedicated 'Auto-Deploy to Cloudflare Pages' section operationalizes autonomous publication once auth is ready, increasing the likelihood of external side effects from a skill execution. Because the content is intended for production legal pages, accidental or premature deployment can create public legal, reputational, and operational exposure.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The terms page hard-codes 'the laws of China' as the governing law without clarifying territorial scope, user location applicability, or whether this is merely example placeholder text. In a skill that generates production-ready legal pages, this can cause deployers to publish legally inaccurate terms, creating enforceability problems, regulatory mismatch, and potential business or consumer disputes.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run(cmd, cwd=None, check=True):
    p = subprocess.run(cmd, cwd=cwd, text=True, capture_output=True)
    if check and p.returncode != 0:
        raise RuntimeError(f"Command failed: {' '.join(cmd)}\n{p.stderr.strip()}")
    return p

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run(cmd):
    p = subprocess.run(cmd, text=True, capture_output=True)
    if p.returncode != 0:
        raise RuntimeError((p.stdout or "") + "\n" + (p.stderr or ""))
    return p.stdout.strip()

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The natural-language content in the Feature Context states "Primary Language: English (U.S.)" as a default recommendation. This can conflict with organizational language/locale policy when the skill appears to mandate a specific locale without offering user choice or documenting a justified regional restriction.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: This code accepts a direct email address or derives one from a base email and then injects it into generated public-facing HTML documents. While the script logs output filenames, it does not clearly warn the user that the supplied email will be published in the generated site content, and there is no inline comment or docstring disclosing that privacy impact.

Static analysis

No suspicious patterns detected.