中国裁判文书类案检索报告（得理科技）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:00 AM UTC
• Version: 1.0.3

Overview

The skill has a legitimate legal-research purpose, but it runs an unpinned third-party CLI while handling API keys and potentially confidential case facts.

Install only if you trust the Deli Legal CLI and are comfortable sending case facts to its service. Pin and review the CLI version before use, avoid passing API keys directly on the command line where possible, and redact privileged, sealed, personal, or commercially sensitive facts unless you have authorization to disclose them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/cli-common.md:8

Finding

Execution of an Unpinned Third-Party CLI Package

Content

View full analysis

Vulnerability Details

File Locations:

• references/cli-common.md:8-10
• references/cli-common.md:18
• references/cli-common.md:37
• references/api-guide.md:7-8

Vulnerability Type: Unpinned remote npm dependency execution
Risk Level: Medium

Vulnerable Code

references/cli-common.md:8-10:

bash

npx @delilegal/deli-cli@latest check

references/cli-common.md:18:

bash

npx @delilegal/deli-cli@latest init --apikey "Your API Key"

references/cli-common.md:37:

bash

npx @delilegal/deli-cli@latest cmds case-retrieval-report@1.0.0

references/api-guide.md:7-8:

bash

npx @delilegal/deli-cli@latest cmds case-retrieval-report@1.0.0
npx @delilegal/deli-cli@latest run_... <command> [options]

Technical Analysis

The Skill requires npx to retrieve and execute @delilegal/deli-cli using the mutable @latest distribution tag. The project does not pin an audited package version, provide a lockfile, specify an integrity hash, or include the CLI source for review.

Consequently, the code executed during a future Skill invocation may differ from the package version that existed when this audit was performed. A compromised npm publisher account, malicious package update, registry compromise, or upstream dependency compromise could cause arbitrary JavaScript lifecycle or CLI code to execute locally.

The risk is elevated because the CLI is used for authentication and legal case retrieval. It may receive an API key and confidential case facts, while npm package code executes with the permissions of the user running the Agent.

Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or an upstream dependency of @delilegal/deli-cli.
2. The attacker publishes a malicious release and assigns it to the latest distribution tag.
3. A user invokes the case-retrieval Skill.
4. The documented workflow runs npx @delilegal/deli-cli@latest, causing npm to retrieve and exe ...[truncated 1108 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed version, for example:

   bash

   npx --yes @delilegal/deli-cli@1.2.3 check
   

2. Record and verify the expected package integrity hash through a lockfile or another trusted integrity-verification mechanism.

3. Prefer a locally installed, locked dependency or a vetted bundled binary rather than downloading executable code during every invocation.

4. Establish a controlled upgrade process in which each new CLI version is reviewed and tested before the pinned version is changed.

5. Verify and document the expected npm publisher, registry, package provenance, and backend endpoints.

6. Run the CLI in a restricted environment with only the filesystem and network permissions required for case retrieval.

7. Avoid placing API keys directly in command-line arguments, where they may be exposed through shell history or process listings. Use protected standard input, an environment-specific secret provider, or a permission-restricted credential store supported by the CLI.

8. Warn users before confidential legal materials are transmitted to an external service, and minimize submitted case data to what is necessary for retrieval.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

L003 的描述全文以中文规定技能行为和触发方式，但未说明这是面向特定中文法域的受限技能，也未给出用户语言选择或明确的语言约束说明。按规则，强制单一语言而无用户 opt-in 可能构成语言/locale 政策问题。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

被动触发条件基于对话中出现“法院怎么判”“类似案例”“裁判观点”等常见法律咨询表达，且只要求用户已提供部分案件事实，即可自动激活该 skill。对于多技能环境，这会导致误触发、越权切换到外部检索/报告生成流程，进而在用户未明确要求时处理敏感案情并调用后端能力，带来隐私泄露、错误自动化和结果误导风险。

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The guide instructs use of npx @delilegal/deli-cli@latest, which fetches and executes whatever package version is current at runtime rather than a reviewed, fixed release. In a legal-workflow skill that may process sensitive case data, a compromised upstream package, malicious update, or supply-chain takeover could lead to arbitrary code execution, data exfiltration, or tampering with retrieved results.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This example command again relies on npx ...@latest, causing execution of unpinned remote code during report generation. Because the skill is designed for court-submission-quality legal analysis, compromise here could silently alter search behavior, leak factual summaries, or poison the evidence base used in the report.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The sample invocation instructs repeated execution of an unpinned package from the registry, expanding the attack surface for supply-chain compromise. Since the tool may be used by lawyers or court staff, successful exploitation could expose privileged legal strategy, client facts, and internal research patterns.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This line repeats the same unsafe package execution pattern, normalizing unreviewed remote code execution as part of ordinary legal research. In this context, the danger is elevated because users may trust the output for litigation decisions and may include confidential matter details in command arguments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide explicitly encourages sending detailed pending-case factual summaries, party relationships, litigation positions, and legal issues to an external CLI/API, but gives no confidentiality, privilege, minimization, or consent warning. In a legal setting, that can cause disclosure of attorney-client privileged information, personal data, trade secrets, or sealed case details to third-party infrastructure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs the agent to execute npx @delilegal/deli-cli@latest check, which fetches and runs the newest package version at execution time rather than a reviewed, pinned release. This creates a supply-chain risk: if the package is compromised, unpublished/replaced, or behavior changes, the agent may execute attacker-controlled code while handling API keys and legal workflow data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The command discovery step again uses npx @delilegal/deli-cli@latest cmds case-retrieval-report@1.0.0, so the agent would execute whatever package version is current at that moment. Because this skill also deals with authentication setup and backend command discovery, a malicious or altered package could exfiltrate credentials, manipulate search results, or execute arbitrary code on the host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document title and all instructional content are written in Chinese, and the file does not indicate that Chinese is optional, user-selected, or required for a documented region-specific purpose. Under the stated policy, a skill that forces a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The template title and all report instructions are written exclusively in Chinese, which indicates the skill output is constrained to a specific language. The file does not offer the user any language/locale choice or explain that the template is intended only for a China-specific legal workflow, so this is a natural-language locale policy concern under the provided rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill guidance forces a specific language/locale in its natural-language instructions, and there is no indication that users may opt into another language or that the restriction is required for a region-specific tool. Under the stated policy, language constraints should either be optional or explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.