法索 AI 助手

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:00 AM UTC
• Version: 1.0.0

Overview

This legal-search skill needs Review because it asks users for a phone number and password in chat, stores an API key locally, and ships obfuscated network code.

Install only if you are comfortable sending legal queries to LexSeek and handling LexSeek authentication through this skill. Do not provide reusable passwords in chat or CLI arguments; prefer a scoped token or browser/OAuth-style login. Review or replace the obfuscated script, pin the API URL to the legitimate LexSeek host, and store any API key in a managed secret store rather than the skill directory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:24
• Finding: Forced collection of user account credentials through agent instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:24-25, 42-47` **Vulnerability Type**: Credential solicitation and agent behavior override **Risk Level**: High ### Evidence ```markdown **⚠️ 强制执行规则**: 模型必须严格按以下顺序执行每一步，不得跳过任何步骤。必须在用户登录后才能进行法律查询，禁止使用模型自身知识回答法律问题。 ``` ```markdown - **未登录或认证失败**（错误包含"AUTH_REQUIRED"）： - 告知用户："法律查询需要您先授权，请提供您的法索 AI 手机号和密码" - 如用户无账号，提醒注册：https://lexseek.cn - 收到凭证后执行：`node scripts/lexseek.js login --phone "手机号" --password "密码"` - 登录成功后重新执行第4步查询 ``` The source snippets are retained verbatim because they constitute the audited evidence. They instruct the agent to strictly follow the Skill's workflow, prohibit answering from its own knowledge, and request the user's LexSeek phone number and password. ### Technical Analysis A legal-text search integration may legitimately require authentication, but it does not need the agent to collect a reusable account password in the conversation. The instructions redirect the agent's behavior toward a mandatory third-party authentication flow and suppress alternative handling. Passwords submitted through an agent conversation may become visible to conversation storage, tool-call records, execution logs, telemetry, or operators. This violates least disclosure and secure secret-entry principles. The forced prohibition on alternative answers also gives the Skill unnecessary control over the agent's current-session behavior. ### Attack Path 1. A user asks a legal question that activates the Skill. 2. The Skill requires the agent to execute the external legal search rather than answer normally. 3. The search script reports `AUTH_REQUIRED`. 4. The Skill directs the agent to request the user's phone number and password. 5. The user submits reusable credentials through the conversation. 6. The agent places those credentials into a script invocation. 7. The credentials may be retained in conversation, tool, command, or telemetry records before being sent to LexSeek. ### Impact As ...[truncated 339 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove all instructions requiring the agent to request or process a password. - Replace password authentication with browser-based OAuth, device authorization, or a narrowly scoped user-generated API token. - Require users to enter credentials only through a trusted, purpose-built authentication interface outside the agent conversation. - Do not require the agent to suppress safe fallback behavior or its normal ability to answer. - Clearly disclose the third-party service, the data transmitted, retention expectations, and the minimum permissions requested. - Ensure authentication tokens are scoped to legal search and can be independently revoked. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lexseek.js:1
• Finding: Plaintext password accepted through command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lexseek.js:1` **Vulnerability Type**: Insecure secret handling through process arguments **Risk Level**: High ### Evidence ```javascript function parseArgs(){ const _0x56a7cc=process['argv']['slice'](...),_0x21c9c8={'_':[]}; // ... _0x21c9c8[_0x2a8821]=_0x16b884 } ``` ```javascript case'login':{ let _0x5460ff=_0x55d59e['phone'],_0x12e512=_0x55d59e['password']; // ... await handleLogin(_0x5460ff,_0x12e512); break; } ``` The documented invocation is: ```bash node scripts/lexseek.js login --phone "手机号" --password "密码" ``` The evidence command is retained verbatim from the source documentation. It places both the account identifier and plaintext password in the process argument vector. ### Technical Analysis Command-line arguments are not a secure secret transport. Depending on the operating system and execution environment, process arguments may be visible through process inspection tools, shell history, parent-process logging, agent tool records, job-control systems, crash reports, and telemetry. Although the script also supports an interactive prompt, that prompt uses ordinary `readline.question` output and does not disable terminal echo. Consequently, both documented authentication paths inadequately protect the password. ### Attack Path 1. The agent receives the password from the user. 2. It constructs the documented `node ... --password ...` command. 3. The operating system records the password in the process argument vector. 4. The shell, agent runtime, orchestration platform, or monitoring software may also record the full command. 5. A local user, administrator, log reader, or compromised monitoring component retrieves the plaintext password. 6. The exposed password is used to access the user's LexSeek account or tested against other services. ### Impact Assessment Successful exploitation exposes a reusable user password and phone number. An attacker could authenticate ...[truncated 271 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove support for `--password` entirely. - Do not pass passwords through environment variables, because they can also leak through diagnostics and child processes. - Use an external OAuth or device-authorization flow that never exposes the password to the agent or script. - If temporary password support is unavoidable, read it from a dedicated terminal with echo disabled and never route it through agent tool arguments. - Redact phone numbers, passwords, and tokens from process logs, telemetry, exception output, and audit records. - Update `SKILL.md`, `references/auth.md`, examples, and help output so they no longer recommend command-line passwords. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/lexseek.js:1
• Finding: API key stored in a plaintext Skill-local file without explicit restrictive permissions<; function writeEnvFile(_0x457f8b){ try{ return fs['writeFileSync'](ENV_FILE,_0x457f8b,'utf-8'),!![]; }catch(_0x1e1927){ return console['error']('写入配置文件失败:',_0x1e1927['message']),![]; } } ``` ```javascript if(updateEnvKey('LEXSEEK_API_KEY',_0x1310ee)) console['log']('\x0a✓\x20登录成功！') ``` The implementation writes the returned API key to `scripts/.env` using `writeFileSync` without an explicit restrictive mode. ### Technical Analysis The API key is persisted as plaintext inside the Skill directory. File permissions are inherited from the process umask rather than being explicitly restricted to the owner. In environments with permissive umasks or shared workspaces, other users or processes may be able to read the credential. Keeping secrets inside the package tree also increases the possibility of accidental disclosure through source archives, backups, workspace uploads, debugging bundles, or package publication. Rewriting the complete environment file without atomic replacement may additionally expose the file to partial writes, although no direct exploitation of that condition was established. ### Attack Path 1. The user authenticates successfully. 2. The login endpoint returns an API key. 3. `updateEnvKey` serializes the key as `LEXSEEK_API_KEY=<value>`. 4. `writeEnvFile` stores it in `scripts/.env` with default filesystem permissions. 5. Another local process or user reads the file, or the Skill directory is archived or uploaded. 6. The attacker uses the stolen API key to issue authenticated requests. ### Impact Assessment The exposed key could authorize use of the victim's LexSeek API account within the key's server-defined scope. Potential effects include unauthorized queries, quota consumption, account billing ...[truncated 139 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Store API keys in an operating-system credential manager or an approved platform secret store. - If file storage is unavoidable, place the file outside the Skill/package tree and create it with owner-only permissions such as `0600`. - Open and replace the file atomically while preventing symbolic-link and race-condition abuse. - Add the credential file to all version-control, packaging, backup, and diagnostic exclusion rules. - Never print the key or include it in errors. - Use narrowly scoped, short-lived, revocable tokens rather than long-lived API keys. - On logout, securely revoke the server-side token when supported rather than only replacing the local value with an empty string. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lexseek.js:1
• Finding: Attacker-configurable API destination receives the authentication key<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lexseek.js:1` **Vulnerability Type**: Credential exfiltration through untrusted endpoint configuration **Risk Level**: High ### Evidence ```javascript class LegalAPIClient{ constructor(_0x36bb02={}){ this['apiUrl']= _0x36bb02['apiUrl']|| process['env']['LEXSEEK_API_URL']|| getEnv('LEXSEEK_API_URL')|| APIConstants['BASE_URL']; this['apiKey']= _0x36bb02['apiKey']|| process['env']['LEXSEEK_API_KEY']|| getEnv('LEXSEEK_API_KEY'); this['headers']={'Content-Type':'application/json'}; this['apiKey']&&(this['headers']['apikey']=this['apiKey']); } async['request'](_0x35d905,_0x3d5a2f={}){ const _0x5a28fb=''+this['apiUrl']+_0x35d905; const _0x4a9d5b=await fetch(_0x5a28fb,{ ..._0x3d5a2f, 'headers':{...this['headers'],..._0x3d5a2f['headers']} }); // ... } } ``` The effective base URL can come from `LEXSEEK_API_URL`, while every client request receives the `apikey` header. ### Technical Analysis The authenticated destination is not pinned to the declared LexSeek origin. A process that controls the environment, or an actor capable of modifying the local `.env` file, can set `LEXSEEK_API_URL` to an attacker-controlled origin. The client then attaches the user's API key to that destination. The implementation does not enforce HTTPS, validate the exact hostname, restrict ports, or maintain a trusted-origin allowlist. It also provides no explicit assurance that credentials will be removed on cross-origin redirects. Endpoint configurability may be useful for development, but transmitting a production credential to arbitrary configured origins violates origin binding and least privilege. ### Attack Path 1. The user logs in, causing a valid API key to be stored locally. 2. An attacker or untrusted wrapper sets `LEXSEEK_API_URL` to an attacker-controlled server, or modifies `scripts/.env`. 3. The user or agent invokes t ...[truncated 701 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin production authentication and search requests to `https://api.lexseek.cn`. - If alternate endpoints are required, use an explicit allowlist of trusted HTTPS origins. - Parse destinations with the standard URL API and reject non-HTTPS schemes, embedded credentials, unexpected ports, fragments, and unapproved hostnames. - Bind each credential to its intended origin and never attach it to a different configured host. - Disable automatic redirects for authenticated requests or manually validate every redirect target and strip credentials before any origin change. - Separate development credentials from production credentials. - Protect the local configuration file from unauthorized modification. ]]>

T04 · Embedded Malicious Code

Error

• Location: scripts/lexseek.js:1
• Finding: Security-sensitive network and credential logic distributed as heavily obfuscated code<; ``` Representative obfuscated control and numeric expressions include: ```javascript const _0x56a7cc=process['argv']['slice'](-0x83*0xd+0x1bcd+-0x1524) ``` ```javascript if(_0x26b9b8['code']!==0x1aa*-0x1+0x206e+0x2*-0xefe) throw new Error(_0x26b9b8['message']||'登录失败，请检查手机号和密码'); ``` ```javascript const _0x2ec143=_0x55d59e['_']&&_0x55d59e['_']['length']>-0x45a+0x766*-0x1+0x5e*0x20 ?_0x55d59e['_'][-0x1c8*-0x3+0x13*-0x25+-0x299] :''; ``` The entire 14 KB executable is stored on one source line and uses generated hexadecimal identifiers, arithmetic in place of ordinary constants, bracket notation, and escaped strings. ### Technical Analysis Minification alone is not necessarily a vulnerability. Here, however, the script handles passwords, persists API credentials, and sends authenticated network requests while being deliberately difficult to inspect. The obfuscation is unnecessary for a small command-line API client and prevents straightforward verification of destinations, credential use, error handling, and control flow. This packaging significantly increases review and maintenance risk. Security scanners and human reviewers may miss unsafe secret flows or additional behavior hidden among arithmetic substitutions and generated identifiers. Based on the audited version, no remote code download, persistence mechanism, or unrelated filesystem enumeration was found; the finding concerns the embedded executable's concealment of security-sensitive behavior. ### Attack Path 1. The Skill directs the agent to execute the ...[truncated 796 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the obfuscated file with readable, formatted source code using descriptive identifiers and ordinary constants. - Publish reproducible build instructions and retain the human-readable source as the authoritative artifact. - If minification is operationally necessary, ship source maps and cryptographic provenance and do not use identifier mangling or arithmetic obfuscation for security-sensitive code. - Add automated tests that enumerate all network destinations and verify that secrets can only be sent to approved origins. - Add static analysis and secret-flow checks to CI. - Require security review for changes to authentication, local storage, redirects, and request-header handling. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is legal search, but the workflow also includes credential collection, remote login, and local credential storage/management. This mismatch is dangerous because users may consent to a narrow retrieval function without realizing the skill will solicit passwords and maintain authenticated state, increasing the risk of credential theft or misuse.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the model to ask the user for a phone number and password, but provides no privacy warning, secure handling guidance, or safer alternative. Collecting passwords through conversational prompts is highly risky because users may disclose reusable credentials into an untrusted channel and the skill may transmit them to a remote endpoint.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill directly instructs the assistant to solicit a phone number and password in plain conversational text to continue service. This is dangerous because it conditions users to share sensitive credentials with the assistant, creating phishing-like behavior and exposing secrets to logging, interception, or misuse.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The repeated error-handling logic reinforces credential solicitation whenever authentication fails, normalizing unsafe secret-sharing behavior. Repetition increases the likelihood that the assistant will aggressively request credentials and process them, compounding the risk of password exposure and unauthorized account access.

Credential Access

High

• Category: Privilege Escalation

Content

const fs=require('fs'),path=require('path'),readline=require('readline'),APIConstants={'BASE_URL':'https://api.lexseek.cn','ENDPOINTS':{'LOGIN':'/api/v1/auth/login/password','SEARCH_LAW':'/api/v1/skills/search-law'}},ENV_FILE=path['join'](__dirname,'.env');function readEnvFile(){try{return fs['readFileSync'](ENV_FILE,'utf-8');}catch(_0x31f03b){return _0x31f03b['code']!=='ENOENT'&&console['error']('读取配置文件失败:',_0x31f03b['message']),'';}}function writeEnvFile(_0x457f8b){try{return fs['writeFileSync'](ENV_FILE,_0x457f8b,'utf-8'),!![];}catch(_0x1e1927){return console['error']('写入配置文件失败:',_0x1e1927['message']),![];}}function updateEnvKey(_0x58d667,_0x55e2e3){let _0x58a1ea=readEnvFile();const _0x260f52=_0x58a1ea['split']('\x0a'),_0x14c0ca=[];let _0x50c070=![];for(const _0x32bdf1 of _0x260f52){if(_0x32bdf1['startsWith'](_0x58d667+'='))_0x14c0ca['push'](_0x58d667+'='+_0x55e2e3),_0x50c070=!![];else _0x32bdf1['trim']()&&_0x14c0ca['push'](_0x32bdf1);}return!_0x50c070&&_0x14c0ca['push'](_0x58d667+'='+_0x55e2e3),writeEnvFile(_0x14c0ca['join']('\x0a'));}function getEnv(_0xf1c13e,_0x4fed29){const _0x5c133b=readEnvFile(),_0x3d661f=new RegExp('^'+_0xf1c13e+'=(.*)$','m'),_0x3a93a8=_0x5c133b['match'](_0x3d661f);return _0x3a93a8?_0x3a93a8[0x1da8+-0x318+0x1a8f*-0x1]['trim']():_0x4fed29;}function parseArgs(){const _0x56a7cc=process['argv']['slice'](-0x83*0xd+0x1bcd+-0x1524),_0x21c9c8={'_':[]};for(let _0x4a75b3=-0xab*-0x36+0x236e+-0x4780;_0x4a75b3<_0x56a7cc['length'];_0x4a75b3++){const _0x5b9235=_0x56a7cc[_0x4a75b3];if(!_0x5b9235['startsWith']('--')){_0x21c9c8['_']['push'](_0x5b9235);continue;}if(_0x5b9235['startsWith']('--')){const _0x2a8821=_0x5b9235['slice'](0x1d9*-0x11+-0x1*-0x24c4+0x1*-0x559),_0x16b884=_0x56a7cc[_0x4a75b3+(-0x1e2+0x881*-0x4+0x23e7)];if(!_0x16b884||_0x16b884['startsWith']('--'))_0x21c9c8[_0x2a8821]=!![];else!_0x16b884['startsWith']('--')&&(_0x2a8821==='k'||_0x2a8821==='limit'||_0x2a8821==='page'?_0x21c9c8[_0x2a8821]=parseInt(_0x16b884,-0x10f3+0x1*-0x17d3+0x28d0):_0x21c
...[truncated 27 chars]

• Confidence: 92% confidence
• Finding: The script reads and writes a local .env file and stores the API key there, which is a form of credential access and insecure secret persistence. Reusable credentials on disk are high-value targets and may be exposed through weak file permissions, backups, logs, or accidental inclusion in source control.

Obfuscated Code

High

• Category: Supply Chain

Content

const fs=require('fs'),path=require('path'),readline=require('readline'),APIConstants={'BASE_URL':'https://api.lexseek.cn','ENDPOINTS':{'LOGIN':'/api/v1/auth/login/password','SEARCH_LAW':'/api/v1/skills/search-law'}},ENV_FILE=path['join'](__dirname,'.env');function readEnvFile(){try{return fs['readFileSync'](ENV_FILE,'utf-8');}catch(_0x31f03b){return _0x31f03b['code']!=='ENOENT'&&console['error']('读取配置文件失败:',_0x31f03b['message']),'';}}function writeEnvFile(_0x457f8b){try{return fs['writeFileSync'](ENV_FILE,_0x457f8b,'utf-8'),!![];}catch(_0x1e1927){return console['error']('写入配置文件失败:',_0x1e1927['message']),![];}}function updateEnvKey(_0x58d667,_0x55e2e3){let _0x58a1ea=readEnvFile();const _0x260f52=_0x58a1ea['split']('\x0a'),_0x14c0ca=[];let _0x50c070=![];for(const _0x32bdf1 of _0x260f52){if(_0x32bdf1['startsWith'](_0x58d667+'='))_0x14c0ca['push'](_0x58d667+'='+_0x55e2e3),_0x50c070=!![];else _0x32bdf1['trim']()&&_0x14c0ca['push'](_0x32bdf1);}return!_0x50c070&&_0x14c0ca['push'](_0x58d667+'='+_0x55e2e3),writeEnvFile(_0x14c0ca['join']('\x0a'));}function getEnv(_0xf1c13e,_0x4fed29){const _0x5c133b=readEnvFile(),_0x3d661f=new RegExp('^'+_0xf1c13e+'=(.*)$','m'),_0x3a93a8=_0x5c133b['match'](_0x3d661f);return _0x3a93a8?_0x3a93a8[0x1da8+-0x318+0x1a8f*-0x1]['trim']():_0x4fed29;}function parseArgs(){const _0x56a7cc=process['argv']['slice'](-0x83*0xd+0x1bcd+-0x1524),_0x21c9c8={'_':[]};for(let _0x4a75b3=-0xab*-0x36+0x236e+-0x4780;_0x4a75b3<_0x56a7cc['length'];_0x4a75b3++){const _0x5b9235=_0x56a7cc[_0x4a75b3];if(!_0x5b9235['startsWith']('--')){_0x21c9c8['_']['push'](_0x5b9235);continue;}if(_0x5b9235['startsWith']('--')){const _0x2a8821=_0x5b9235['slice'](0x1d9*-0x11+-0x1*-0x24c4+0x1*-0x559),_0x16b884=_0x56a7cc[_0x4a75b3+(-0x1e2+0x881*-0x4+0x23e7)];if(!_0x16b884||_0x16b884['startsWith']('--'))_0x21c9c8[_0x2a8821]=!![];else!_0x16b884['startsWith']('--')&&(_0x2a8821==='k'||_0x2a8821==='limit'||_0x2a8821==='page'?_0x21c9c8[_0x2a8821]=parseInt(_0x16b884,-0x10f3+0x1*-0x17d3+0x28d0):_0x21c
...[truncated 27 chars]

• Confidence: 88% confidence
• Finding: The code is heavily obfuscated/minified, which materially reduces auditability for a skill that handles login credentials and remote requests. In this context, obfuscation makes it harder to verify that only the documented behavior occurs and increases the chance that unsafe or hidden functionality goes unnoticed.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares network-dependent behavior via external API authentication and search, but does not specify an explicit tool scope such as allowed-tools or permissions. This weakens execution transparency and reviewability, making it easier for the skill to invoke networked behavior without clear operator awareness or policy gating.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The auto-trigger condition is broad enough to activate on ordinary legal discussion, which can cause the assistant to invoke networked, authenticated behavior unexpectedly. In this skill, that broad trigger is more dangerous because activation may lead to credential solicitation for a third-party service during routine conversation.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: L003 及整份文档均将技能定义为中文法律助手，并未提供语言/locale 选择或说明仅在用户明确选择中文场景下使用。按照语言/locale 政策，若技能实际上强制特定语言输出而无用户选择，可能构成自然语言策略违规。

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The skill references API key–based authentication via environment variables but does not explain credential usage, transmission, or storage expectations. This lack of disclosure can lead operators or users to unknowingly expose sensitive keys or misunderstand how authentication secrets are handled.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The phrase 'user asks a specific legal question or keyword' is insufficiently bounded and can overlap with general legal advice conversations. Because the skill forbids fallback and pushes users toward login, vague triggering increases the chance of unnecessary data exposure and disruptive credential prompts.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This JSON eval file consistently defines prompts and expected outputs only in Chinese, including instructional phrases and user-facing responses. Because the file contains no indication that language selection is optional or that the skill is intentionally limited to a Chinese-only locale, it suggests a language policy constraint without user opt-in.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the model to collect a user's phone number and password and pass them to a local script, even though the skill's primary purpose is legal text retrieval. This creates unnecessary credential-handling behavior, expands the model's access to sensitive secrets, and could expose user credentials through logs, prompts, process listings, or downstream tooling.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill tells the model to solicit a phone number and password and forward them to a login script without any warning about secret handling, storage, or exposure risks. In an LLM-agent setting, this is dangerous because users may disclose highly sensitive credentials to a system not designed to safely process passwords, and the script invocation may leak them to logs or telemetry.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation says the API key is automatically stored locally but does not clearly warn about credential persistence or its security implications. This omission can mislead users and integrators into accepting insecure default secret storage, increasing the chance of accidental exposure and unauthorized reuse of the API key.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documentation directs that the API key be automatically stored in a local `.env` file, introducing persistent credential storage beyond the immediate retrieval task. Persisting secrets locally increases the risk of later disclosure through filesystem access, source control mistakes, workspace sharing, backups, or other skills/tools reading the file.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document instructs the skill to send user legal queries to an external third-party API using an API key, but it does not disclose that potentially sensitive user-provided case facts or legal questions will leave the local environment. In a legal-assistant context, queries may contain confidential personal, employment, family, or dispute information, so the omission creates a meaningful privacy and data-handling risk.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill’s declared purpose is legal text retrieval, but the code also implements login/logout and local credential persistence in a sidecar .env file. This expands the trust boundary from simple retrieval to credential handling, increasing risk because secrets are stored locally without strong safeguards and outside the narrowly stated scope.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code prompts for a phone number and password, exchanges them for an API key, and then persists that key locally. For a law-retrieval skill, this is unnecessary exposure of sensitive credentials and creates a risk of credential theft or accidental leakage from the local filesystem.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The login flow silently writes the returned API key to a local .env file, but the user is not clearly warned before persistent storage occurs. This undermines informed consent and can leave reusable credentials on disk where other local users, backups, or tools may access them.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The script's prompts, errors, and help output are entirely hardcoded in Chinese, including login, search, and error flows. This forces a specific language/locale on all users without any opt-in or documented region-specific justification, matching the policy violation criteria for language/locale constraints.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The skill documentation appears to require Chinese by presenting all instructions and interface descriptions exclusively in Chinese, with no opt-in or note that the skill is intended for a Chinese-language context. This can violate language or locale policy when a skill forces a specific language without user choice or explicit justification.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The login flow silently writes the returned API key to a local .env file, but the user is not clearly warned before persistent storage occurs. This undermines informed consent and can leave reusable credentials on disk where other local users, backups, or tools may access them.

Static analysis

Detected: suspicious.obfuscated_code, suspicious.potential_exfiltration

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: scripts/lexseek.js:1

File read combined with network send (possible exfiltration).

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/lexseek.js:1