ClawHub
Back to skill

Security audit

Legal Guard

Security checks for vulnerabilities and agentic risk

Overview

Legal Guard is a Markdown-only safety skill that pauses legal or financial commitments for explicit user approval, with a caution around its permanent approval option.

Install this only if you want your agent to stop before signing, accepting terms, confirming subscriptions, or approving wallet/signature requests. Prefer `/approve <id> allow-once` for every legal or financial action; avoid `allow-always` unless you are certain the host approval system scopes it narrowly and you can revoke it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
## Why Legal Guard?

AI agents are incredibly efficient at navigating web flows — including DocuSign, Terms of Service gates, and subscription sign-ups. Without guardrails, an agent might interpret "Go ahead" as permission to click "Sign" without you ever seeing the fine print. A free trial auto-converts to a paid plan. A CLA transfers your IP. A changed ToS slips in an arbitration clause.

**Legal Guard creates a hard stop before any of that happens.**
Confidence
80% confidence
Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger list is very broad and includes loosely related categories like banners, prompts, sign-ups, and wallet requests without explicit limits. Overbroad scope can either cause accidental approval fatigue and bypass behavior or lead implementers to apply weak heuristics that miss truly binding events.

Vague Triggers

Medium
Confidence
95% confidence
Finding
Saying the skill 'activates automatically when the agent detects a triggering context' does not clearly define positive and negative boundaries for activation. Ambiguous activation criteria can cause inconsistent enforcement, creating gaps where legal actions are missed or, conversely, broad interception that trains operators to bypass the control.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The README documents `/approve <id> allow-always`, which weakens the stated safety model of per-action human approval for legal commitments. Persistent approval for a broad action type could let future signatures, ToS acceptances, or subscription confirmations proceed without fresh review, undermining the core legal safeguard.

Static analysis

No suspicious patterns detected.