corporate-legal

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:03 AM UTC
• Version: 0.1.0

Overview

This legal-workflow skill is coherent, but it needs review because it can store sensitive legal material and reusable legal rules in shared systems without clear per-item consent or validation.

Review before installing. Use this only in a workspace approved for confidential legal work, keep Notion export off unless the user explicitly approves the exact destination and content, redact identity and contract details where possible, and do not allow reusable legal standards or risk databases to be updated without authorized legal review and source validation.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:106

Finding

Unvalidated Legal Content Can Be Written into Persistent Methodology and Risk Databases

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 106
Vulnerability Type: Persistent state poisoning
Risk Level: Medium

Vulnerable Instruction

The following is a faithful English translation of the complete instruction at the identified location:

markdown

| 6. Retrospective consolidation | (New) | Consolidate corrections from the current legal opinion or compliance review into legal methodology → update the legal standards library and risk database → create reusable review checklists |

Technical Analysis

The skill instructs the agent to convert corrections from an individual interaction into persistent legal methodology, a legal standards library, and a risk database. It does not require:

• Authentication or authorization for the person supplying the correction.
• Independent validation against authoritative legal sources.
• Human approval before persistent publication.
• Separation of user-provided facts from trusted legal rules.
• Provenance, versioning, expiration, or rollback controls.
• Sanitization of instructions embedded in uploaded legal materials.

Consequently, attacker-controlled content can cross the trust boundary between a single session and persistent state. A malicious user could present an incorrect legal proposition as a correction, request that the agent adopt it, and cause the resulting rule to influence future reviews.

This matches agent memory poisoning rather than ordinary report archiving because the stated objective is to modify reusable methodology and risk data that affect later sessions.

Attack Path

1. An attacker invokes a legal-opinion or compliance-review workflow.
2. The attacker supplies a plausible but false correction, such as an inaccurate statutory threshold, obsolete filing exemption, or intentionally weakened compliance requirement.
3. The agent accepts the correction while completing the task.
4. During the mandatory retrospective ...[truncated 1310 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic knowledge-base updates from the normal execution workflow.
2. Treat all user statements, uploaded documents, and model-generated corrections as untrusted candidates.
3. Require explicit human approval by an authorized legal knowledge owner before publication.
4. Validate legal rules against authoritative, current sources and record the jurisdiction, effective date, citation, reviewer, and source URL.
5. Store proposed changes in a quarantined review queue rather than the production standards library.
6. Implement immutable version history, audit logs, approval records, and one-click rollback.
7. Separate factual case records from normative legal rules so case-specific assumptions cannot become global policy.
8. Prevent document content from issuing storage or policy-update instructions; parse uploaded material strictly as data.
9. Add expiration and scheduled revalidation for time-sensitive legal rules.
10. Reword the instruction to state that the agent may only propose a reusable lesson in the current response and must not persist it without explicit authorization and verified sources.

T09 · Insecure Skill Coding Practices

Error

• Location: references/legal-documents.md:113

Finding

Sensitive Legal Documents Are Archived to Notion Without Explicit Per-Document Consent or Data-Minimization Controls

Content

View full analysis

Vulnerability Details

File Location: references/legal-documents.md, lines 113-115
Vulnerability Type: Unsafe external persistence of sensitive legal and identity information
Risk Level: High

Vulnerable Instructions

The following is a faithful English translation of the complete relevant archive block:

markdown

### Step 5: Document Archiving

**If Notion is connected:**
- Write the legal document to a Notion knowledge-base page so that the legal team can collaboratively review and revise it.

The same template requires collection and inclusion of highly sensitive information. The relevant input requirement at lines 19-24 translates as:

markdown

1. Document type: lawyer's letter, legal opinion, complaint, defense, representation statement, arbitration application, or enforcement application.
2. Party information: name, address, and contact details of the sender, claimant, or defendant; a legal entity must include its unified social credit code.
3. Factual background: cause of dispute, contractual relationship, breach, and losses.
4. Claim or purpose: the intended legal effect.
5. Evidence, where applicable: list of available evidence.
6. Special requirements, optional: tone, law-firm letterhead, and selected court.

Lines 79-80 additionally require a natural person's name, sex, ethnicity, date of birth, identity-card number, address, and contact information to appear in generated documents.

Technical Analysis

The archive step uses connector availability as the only stated condition for writing the entire legal document to Notion. It does not require:

• Explicit user confirmation for the specific document.
• Verification of the destination workspace, database, or page.
• Least-privilege access controls.
• Redaction or tokenization of identity-card numbers and contact details.
• Exclusion of privileged legal analysis, evidence, or litigation strategy.
• Retention li ...[truncated 2959 chars]

Remediation

View remediation

Remediation Suggestions

1. Make external archiving opt-in for every document, even when a connector is already configured.
2. Before writing, display the destination workspace, database, page visibility, data categories, and retention period, then obtain explicit confirmation.
3. Default to returning the document in the current session without external persistence.
4. Automatically detect and redact identity-card numbers, personal addresses, contact details, signatures, bank information, and unrelated third-party data.
5. Offer a sanitized collaboration copy while keeping the unredacted original in an approved legal document-management system.
6. Require a confidentiality classification and block external storage for privileged, litigation-sensitive, regulated, or restricted documents unless an authorized reviewer approves it.
7. Use a dedicated private database with least-privilege connector credentials, restricted sharing, disabled public links, and periodic access reviews.
8. Encrypt stored content where supported and define retention, deletion, legal-hold, and incident-response procedures.
9. Record an audit event containing the approving user, destination, timestamp, sensitivity classification, and fields redacted.
10. Apply the same controls to every Notion archive instruction in the other reference templates.
11. For electronic-signature data, avoid persisting signer email addresses or identity-verification information unless strictly necessary.
12. Add a hard rule that connector availability alone never constitutes authorization to transmit or retain user data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (20)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section promotes writing legal documents to Notion for collaboration without clearly warning that highly sensitive legal data—party identities, contact details, case facts, evidence, and possibly government IDs—may be transmitted to and stored in a third-party service. In a legal workflow, that omission materially increases the risk of unintended disclosure, over-sharing, and noncompliant handling of confidential or regulated personal information.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The archiving step operationalizes sending completed legal documents to Notion but still lacks an explicit warning or confirmation flow for external storage of sensitive legal material. Because the generated documents may contain full identity details, litigation strategy, and evidence summaries, automatic or assumed archival to a third-party platform creates significant confidentiality and privacy risk in a high-sensitivity legal context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README describes workflows involving due diligence, litigation records, compliance review, legal drafting, and e-sign initiation, all of which can involve highly sensitive corporate, personal, and dispute-related data. Without warnings about data sensitivity, confidentiality, retention, or safe handling, users may submit protected information without understanding the privacy, regulatory, or privilege implications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Many listed trigger keywords are broad phrases such as '法律文书', '风险评估', and '查案例', which are common in ordinary discussion and may match unrelated or underspecified user requests. Because this skill covers sensitive legal functions, generic routing terms increase the chance of accidental invocation, incorrect subskill selection, and unnecessary exposure of confidential business or dispute information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README says users can 'naturally trigger' the skill via general conversation, but it does not define explicit invocation boundaries or confirmation steps. In a multi-skill environment, this can cause unintended activation on ambiguous legal-related requests, potentially routing sensitive matter into the wrong workflow or initiating processing of confidential legal data without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description advertises broad natural-language triggers across many legal workflows, which can cause accidental routing of ordinary user requests into sensitive legal-task flows. In a legal skill, misrouting is more dangerous because it may lead the agent to request or process confidential company, litigation, compliance, or contract data without sufficiently confirming user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The routing logic relies on keyword and scenario matching but does not define hard scope boundaries, negative conditions, or disambiguation safeguards beyond a general 'ask the user' fallback. This can let ambiguous prompts be interpreted as legal instructions, causing incorrect template execution, unnecessary collection of regulated data, or generation of legal output based on the wrong task class.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly supports writing case analysis reports to Notion, but the surrounding description does not clearly warn users that sensitive legal facts, dispute details, and potentially personal or corporate confidential information may be transmitted to a third-party service. In a corporate legal context, this increases privacy, confidentiality, and compliance risk because users may reasonably assume the analysis stays within the assistant unless informed otherwise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs writing due-diligence reports into Notion, which can contain sensitive corporate investigation data, but it does not warn about data minimization, customer consent, retention, access control, or third-party transfer risks. In a legal/compliance workflow, this omission can lead to unauthorized disclosure or over-sharing of sensitive business and potentially personal data through an external SaaS platform.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown skill forces a specific language/locale for all instructions and outputs, and there is no indication that users may choose another language. The policy allows locale constraints only when the skill offers opt-in or clearly documents a justified regional limitation, which this file does not do.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire skill specification, headings, prompts, and output template are written exclusively in Chinese, including the required report format and generated document structure. There is no statement allowing the user to choose another language or clarifying that the locale restriction is intentional and justified, which creates a language-policy issue under the natural-language policy rule.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly suggests writing signature configuration, status tracking, and post-signature records to Notion, which can include sensitive contract metadata, signer names, emails, legal entity details, approval routing, and execution status. In a corporate legal context, exporting this data to a general knowledge base without clear data-minimization, access-control, retention, and confidentiality guidance creates a realistic risk of unauthorized internal exposure or oversharing through connector misconfiguration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly supports writing legal daily or weekly reports into Notion, but it does not warn that those reports may contain sensitive legal, compliance, litigation, contract, or regulatory information. This creates a real data-handling risk because users may unknowingly send confidential or privileged content to an external SaaS connector without data minimization, approval, or access-control review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The title and core description state that the skill generates legal documents according to Chinese judgment-document standards, and the entire skill is written as a Chinese-only workflow. This imposes a specific language/locale behavior without an explicit user opt-in or a documented policy justification such as restricting the skill to China-specific legal practice contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s title, instructions, workflow, and output format all require interaction in Chinese, but there is no user opt-in, alternative language option, or stated region-specific justification. This can violate language/locale policy because it effectively forces a specific language for all users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The entire user-facing README is presented only in Chinese, with no indication that users may choose another language or locale. If the organization requires language choice or opt-in rather than a forced locale, this constitutes a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

文件整体以中文定义技能能力与执行规范，且未说明是否支持根据用户偏好切换输出语言或允许用户选择语言。对于通用企业法务技能，这种默认单一语言约束若被视为固定输出要求，可能构成未提供用户语言选择的 locale 策略问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The entire skill specification, prompts, and output format are fixed in Chinese, which can constitute a language policy constraint if users are not given an explicit option to choose another language. The file does not document that the locale restriction is intentional or region-specific beyond the legal subject matter.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file presents all user-facing guidance and output format in Chinese, which effectively fixes the interaction language. There is no indication that the user can choose another language or that the Chinese-only constraint is a documented, justified regional limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill heading and the entire prescribed report format are Chinese-specific, and the document does not indicate that users may request another language. This can be a language/locale policy issue because the skill effectively fixes the interaction and output language without opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.