Baozheng Skills

• Outcome: Review
• Latest audit: Aug 15, 2026 · 5:51 PM UTC
• Version: 0.1.0

Overview

This is a coherent Chinese-law assistant, but it needs Review because a legal deadline calculator can produce dangerously wrong dates and the templates request sensitive identity and financial data without strong handling limits.

Install only if you are comfortable using a PRC-law focused assistant that may ask for real legal case details. Treat generated legal deadlines, complaint drafts, and criminal materials as drafts for lawyer review, and avoid entering full ID numbers, bank records, or third-party personal data unless necessary; redact where possible. The deadline calculator should be fixed before relying on it for 60-day periods.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares operational behaviors requiring file reads and network access, including reading reference files and calling an external legal API, but does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: the host may grant broader capability than users or reviewers realize, and downstream modules could perform network/file actions without explicit review boundaries.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The calculator models all limitation periods with a single `years: int` field, but some rules in the data set are actually day-based, such as `遗赠接受` with value `60`. In `_compute`, any `rule.years >= 1` is treated as a year count, so a 60-day deadline is calculated as 60 years, which can materially mislead users about legal deadlines and cause missed filing windows.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger phrases include generic everyday terms such as '咨询', '怎么办', '合法吗', and '能不能', which can match many unrelated conversations and cause accidental activation. In a skill that can load additional modules, read files, and make network requests, over-broad activation increases the chance of unintended data handling or unreviewed tool use in contexts the user did not intend.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The activation scope covers a very wide range of legal topics and tasks, while the exclusions are minimal and high level. This ambiguity makes routing unpredictable and can cause the skill to engage on borderline or mixed-intent prompts, especially since the skill also instructs the agent to prioritize itself over general model behavior via referenced activation rules.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This template solicits a large amount of highly sensitive personal and corporate information, including names, addresses, phone numbers, identity-related details, and unified social credit codes, but provides no privacy notice, minimization guidance, retention limits, or handling safeguards. In the context of an AI-powered legal service skill, this increases the risk of unnecessary collection, overexposure to downstream systems or logs, and noncompliance with privacy obligations if the data is processed or stored insecurely.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The template solicits a large amount of personal and quasi-sensitive data, including identity details, contact information, residence, employer, legal representative data, and unified social credit codes, but does not include any explicit privacy notice, minimization guidance, retention limits, or handling safeguards. In a legal-services skill, this increases the risk that users will overshare regulated personal data into the agent or downstream systems without understanding how it will be stored, transmitted, or used.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The template requests a large amount of personal and organizational information, including identity, contact, address, employment, and corporate registration details, but provides no privacy notice, retention limitation, access control guidance, or data-minimization instruction. In a legal-services skill, this increases the risk that an agent or downstream system will over-collect or mishandle sensitive case data, leading to privacy breaches or noncompliant processing.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This template solicits a broad set of personally identifiable and potentially sensitive data, including identity numbers, addresses, phone numbers, birth dates, and organizational registration details, but does not include any privacy minimization, redaction, retention, or secure-handling guidance. In an AI-agent skill context, that omission increases the risk that users will disclose more data than necessary and that downstream systems, logs, prompts, or generated outputs may expose or mishandle regulated personal information.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This template solicits extensive personal and organizational data, including identity details, addresses, phone numbers, dates of birth, and legal-representative information, but does not include any privacy notice, data-minimization guidance, retention limits, or handling safeguards. In a legal-services skill, this increases the risk that users disclose unnecessary sensitive information to the agent or downstream systems without understanding how it will be processed, stored, or protected.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The template explicitly instructs collection of highly sensitive personal and financial materials, including identity numbers, bank流水, transaction records, audio/video sales recordings, and chat logs, but provides no privacy notice, minimization guidance, masking requirements, or handling restrictions. In a legal-services skill, this is especially risky because users are likely to submit real case files containing regulated personal and financial data, increasing the chance of unnecessary over-collection, disclosure, or insecure downstream processing.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The module is explicitly scoped to PRC law and Chinese-language legal workflows, but the excerpt does not require the agent to first confirm the user's jurisdiction, governing law, or preferred language. If a user presents a non-China matter or mixed-jurisdiction dispute, the skill may confidently provide inapplicable legal guidance, creating a material safety and reliability risk in a legal-advice context.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The module is entirely written to operate in Chinese and prescribes fixed Chinese output formats without offering a user language choice or documenting that Chinese is a necessary locale restriction. In a legal-assistance skill, this can cause users with limited Chinese proficiency to misunderstand criminal-procedure guidance, deadlines, rights, or disclaimers, increasing the risk of harmful reliance on inaccurate comprehension rather than a direct software compromise.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The activation rules enumerate many broad everyday terms such as '怎么办', '怎么处理', and '赔偿', causing the legal skill to trigger on ambiguous user requests that may not actually require specialized legal routing. In an agentic system, this can override normal intent selection, funnel unrelated or low-confidence requests into a high-authority legal workflow, and increase the chance of inappropriate advice, unnecessary data collection, or policy-bypassing scope expansion.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The statement that any question involving Chinese law, regulations, contracts, litigation, rights protection, or disputes 'must' activate the skill creates an effectively unbounded trigger condition. This is dangerous because it removes meaningful routing boundaries, lets the skill dominate broad classes of conversations, and can misclassify adjacent topics such as translation, news, education, or general discussion as legal engagement.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file forces handling through a Chinese-law skill whenever broad legal-related criteria are met, but it does not provide user choice regarding jurisdiction, locale, or response language. In practice, this can route users into the wrong legal framework or language context, especially for cross-border, comparative-law, or multilingual requests, increasing the risk of misleading advice.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file defines the interaction protocol entirely in Chinese and presents fixed Chinese-language user-facing output without any language negotiation or fallback. In a legal-services skill, this can cause users to misunderstand task plans, legal analysis, or drafting steps, which may lead to materially incorrect decisions or consent to actions they did not fully understand.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 智慧半岛法律技能包 — 外部依赖
# 加载技能时自动检测此文件并安装缺少的包

requests>=2.25.0
python-docx>=0.8.11

• Confidence: 94% confidence
• Finding: The dependency specification uses a lower bound only (`requests>=2.25.0`), which allows installation of any future version and makes builds non-reproducible. This increases supply-chain risk because the resolved package may unexpectedly include breaking changes or a newly introduced malicious or vulnerable release.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 加载技能时自动检测此文件并安装缺少的包

requests>=2.25.0
python-docx>=0.8.11

• Confidence: 91% confidence
• Finding: `python-docx>=0.8.11` is also unpinned, so installation may resolve to different versions over time without review. In an auto-installing skill environment, that unpredictability increases supply-chain exposure and can introduce vulnerable or incompatible code into the runtime.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.