ClawHub
Back to skill

Security audit

Founder Legal Copilot

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for a founder legal assistant, but it persists sensitive legal deal data and uses external plugins and services with weak installation and storage safeguards.

Review before installing. Use this only if you are comfortable sending legal documents, diligence queries, and possibly voice narration content to the listed third-party services. Pin and verify plugins, restrict Apify tools, avoid the documented Redis docker command as written, bind Redis to localhost or a private authenticated service, and confirm how stored deal data can be deleted. Treat all legal outputs as drafts for attorney review.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:268
Finding

Redis Troubleshooting Command Exposes Persistent Legal Data Without Authentication

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:62
Finding

Mutable and Inconsistently Named Third-Party Plugins Create a Supply-Chain Substitution Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (17)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

Copy .env.example to .env and populate:

bash
cp .env.example .env

Required keys:

Ssd 3

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The 'Deal Memory' feature explicitly advertises cross-session recall of generated and reviewed legal artifacts by deal name, creating a direct exposure path for highly sensitive legal and fundraising information. In a legal copilot context, recalled data could include contract terms, investor identities, diligence results, and strategic transaction details, making unauthorized access particularly damaging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that generated SAFEs and related deal history are stored in Redis for future reference, but gives no explicit warning that sensitive fundraising and legal data will be retained. Legal documents often contain confidential terms, counterparties, and corporate details, so silent persistence creates confidentiality and privacy risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Persistent storage of deal and contract information across sessions creates a clear natural-language pathway for retaining sensitive legal artifacts without documented safeguards. If memory access is overly broad, compromised, or retained indefinitely, confidential financing and contract data could be exposed or reused inappropriately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The due-diligence workflow explicitly collects and aggregates sensitive identifying and legal-record data, including EINs, officers, bankruptcy, tax lien, and UCC information, but provides no explicit notice about privacy, lawful basis, retention, or third-party disclosure. In a legal-assistance context, users may submit highly sensitive corporate data, so omission of handling warnings increases the risk of over-collection, improper sharing, and compliance issues.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Storing due-diligence reports for later follow-up implies retention of compiled sensitive corporate and identifying data, potentially including adverse legal records. Because diligence outputs aggregate multiple sources into one accessible record, retention amplifies confidentiality, misuse, and compliance risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Voice narration sends report contents to ElevenLabs, a third-party audio provider, yet the skill does not warn users that confidential legal analysis may leave the primary environment. This is especially risky because reports may contain sensitive business, contract, or diligence findings not intended for external processors.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config.json (reported line 10)May include surrounding context.

json
"sponsors": {
    "contextual_ai": {
      "role": "RAG grounded analysis on legal templates",
      "api": "https://api.contextual.ai/v1/",
      "docs": "https://docs.contextual.ai",
      "features": ["safe_generator", "contract_reviewer"],
      "model": "contextual-rag-v2"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest explicitly enables persistent cross-session memory and live legal-data scraping, but does not declare any user-facing warning, consent flow, or retention/transmission notice in the configuration. In a legal copilot, users may provide sensitive business, contract, cap-table, or PII-heavy material, so silent retention and external retrieval materially increase privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config.json (reported line 43)May include surrounding context.

json
},
    "friendliai": {
      "role": "Fast inference provider (GLM-5, 9x cheaper than GPT-4)",
      "baseUrl": "https://api.friendli.ai/serverless/v1",
      "docs": "https://friendli.ai/docs",
      "features": ["all"]
    },

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config.json (reported line 49)May include surrounding context.

json
},
    "elevenlabs": {
      "role": "Multilingual voice narration of legal reports",
      "api": "https://api.elevenlabs.io/v1/",
      "docs": "https://elevenlabs.io/docs",
      "default_voice_id": "21m00Tcm4TlvDq8ikWAM",
      "model": "eleven_turbo_v2_5",

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The glossary presents legal and tax concepts such as 83(b) elections and IRS treatment in a US-specific way without clearly scoping them to the United States or warning that rules differ by jurisdiction. In a legal copilot for founders, users may rely on this as generally applicable guidance, creating a meaningful risk of incorrect compliance, tax, or structuring decisions outside the US.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The corporate-structure content states that Delaware C-Corps are the standard structure and frames that advice as broadly applicable, but it is specific to US venture-backed startups. In a founder legal assistant, this can mislead non-US founders or even some US founders with different business models into adopting an unsuitable structure, with downstream legal, tax, and governance consequences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The content makes a broad legal claim that non-solicitation clauses are enforceable in most states, including California, without sufficient qualification. In a legal copilot, users may rely on this as actionable advice, and California employment restrictive-covenant law is nuanced and frequently litigated, so overbroad statements can mislead users into adopting unenforceable or unlawful terms.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The prompt explicitly directs collection of public data about entities and individuals, including executive backgrounds, bankruptcy history, sanctions screening, and officer identity checks, but it does not warn users that the workflow processes potentially sensitive personal data. In a due-diligence context, omission of privacy and handling guidance can lead to overcollection, inappropriate use of personal data, and legal/compliance exposure, especially for key-hire investigations involving individuals.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · templates/nda-mutual.md (reported line 28)May include surrounding context.

md
## 2. Definition of Confidential Information

"Confidential Information" means any and all non-public information disclosed by either Party to the other Party, whether orally, in writing, electronically, or by any other means, including but not limited to:

(a) Business plans, strategies, and financial information
(b) Product designs, specifications, and source code