legal-cn-api

• Outcome: Review
• Latest audit: May 28, 2026 · 4:45 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its legal-search API purpose, but it needs review because it handles powerful wallet credentials and includes an unrelated API key file.

Review before installing. Use an isolated environment, remove and rotate the bundled Moltbook key, use only a dedicated low-balance wallet or safer secret store for x402 configuration, pin dependencies and the Meilisearch image, back up any existing Meilisearch index before imports, and verify the legal dataset source and actual update date before relying on results.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The rate limiter is intended to operate per client, but the code hardcodes every request to the same IP address (127.0.0.1). This causes all users to share one global bucket, enabling trivial denial of service by exhausting the shared quota and also breaking the intended anti-abuse control.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs users to place a wallet private key into a local config file, but provides no warning about secret handling, storage protections, or exclusion from source control. In an agent-oriented skill, this is dangerous because operators may paste real signing keys into insecure files, exposing funds if the file is leaked, logged, committed, or read by other tools.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The script embeds and uses a Meilisearch master key directly in source code. If this file is committed, shared, or exposed through logs or backups, an attacker could obtain full administrative access to the Meilisearch instance, including reading, modifying, or deleting indexes and documents.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script hardcodes Meilisearch's administrative master key directly in source code, which creates a credential exposure risk if the file is committed, shared, logged, or reused outside a trusted local environment. Because the master key grants full control over the search instance, an attacker who obtains it could read, modify, or delete indexes and potentially pivot into connected systems or sensitive legal data workflows.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

meilisearch>=0.3.0
fastapi>=0.100.0
uvicorn>=0.29.0
python-multipart>=0.0.6

• Confidence: 98% confidence
• Finding: The dependency is specified with only a lower bound (`>=0.3.0`), which allows future unreviewed versions to be installed. This creates supply-chain risk and undermines reproducible builds, especially for a network-facing service stack where dependency changes can introduce breaking security regressions or newly vulnerable releases.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

meilisearch>=0.3.0
fastapi>=0.100.0
uvicorn>=0.29.0
python-multipart>=0.0.6
pydantic>=2.0.0

• Confidence: 99% confidence
• Finding: `fastapi>=0.100.0` is unpinned, so installations may resolve to different versions over time, including versions with undiscovered or newly introduced vulnerabilities. In an API service dependency set, this increases attack surface and makes security posture unpredictable.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

meilisearch>=0.3.0
fastapi>=0.100.0
uvicorn>=0.29.0
python-multipart>=0.0.6
pydantic>=2.0.0
httpx>=0.27.0

• Confidence: 98% confidence
• Finding: `uvicorn>=0.29.0` permits uncontrolled upgrades, which can pull in versions with security regressions or incompatible behavior. Since Uvicorn is the HTTP server boundary, unexpected version changes can directly affect request handling and exposure to network-originated attacks.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

meilisearch>=0.3.0
fastapi>=0.100.0
uvicorn>=0.29.0
python-multipart>=0.0.6
pydantic>=2.0.0
httpx>=0.27.0
pillow>=10.0.0

• Confidence: 99% confidence
• Finding: `python-multipart>=0.0.6` is unpinned despite being used to parse attacker-controlled multipart input. Unbounded version resolution increases the risk of consuming vulnerable or behavior-changing parser versions in production.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fastapi>=0.100.0
uvicorn>=0.29.0
python-multipart>=0.0.6
pydantic>=2.0.0
httpx>=0.27.0
pillow>=10.0.0
x402>=0.2.0

• Confidence: 98% confidence
• Finding: `pydantic>=2.0.0` allows arbitrary newer versions to be selected, weakening reproducibility and making it easier for vulnerable or incompatible releases to enter builds unnoticed. As a core validation library, defects here can affect parsing and denial-of-service resilience across the application.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

uvicorn>=0.29.0
python-multipart>=0.0.6
pydantic>=2.0.0
httpx>=0.27.0
pillow>=10.0.0
x402>=0.2.0
web3>=6.0.0

• Confidence: 98% confidence
• Finding: `httpx>=0.27.0` is unpinned, which can lead to inconsistent installations and unintended adoption of releases with security-impacting behavior changes. Because HTTP clients often process attacker-influenced URLs and headers, dependency drift can materially affect risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-multipart>=0.0.6
pydantic>=2.0.0
httpx>=0.27.0
pillow>=10.0.0
x402>=0.2.0
web3>=6.0.0

• Confidence: 99% confidence
• Finding: `pillow>=10.0.0` is unpinned in a package that likely handles images, which is especially risky because image parsers are historically vulnerability-prone. Allowing arbitrary future versions increases exposure to memory corruption, resource exhaustion, or parsing flaws from untrusted files.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pydantic>=2.0.0
httpx>=0.27.0
pillow>=10.0.0
x402>=0.2.0
web3>=6.0.0

• Confidence: 95% confidence
• Finding: `x402>=0.2.0` is unpinned, so builds may consume unreviewed versions of a payment/web3-related SDK. Dependency drift in security-sensitive SDKs can affect authentication, request signing, or trust assumptions without any code changes in the application.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

httpx>=0.27.0
pillow>=10.0.0
x402>=0.2.0
web3>=6.0.0

• Confidence: 97% confidence
• Finding: `web3>=6.0.0` allows arbitrary later versions, increasing supply-chain and reproducibility risk for blockchain-related functionality. Web3 libraries often interact with external nodes and URLs, so version drift can alter security behavior in network-sensitive code paths.

Known Vulnerable Dependency: fastapi — 3 advisory(ies): CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High

• Category: Supply Chain
• Confidence: 76% confidence
• Finding: The file permits installation of vulnerable FastAPI versions because it does not constrain to a known patched release range. Even though `>=0.100.0` may avoid some older CVEs, the current specification does not demonstrate that all allowed versions are free of known issues, so the dependency policy remains unsafe for an API framework exposed to user requests.

Known Vulnerable Dependency: python-multipart — 5 advisory(ies): CVE-2024-24762 (python-multipart vulnerable to Content-Type Header ReDoS); CVE-2024-53981 (Denial of service (DoS) via deformation `multipart/form-data` boundary); CVE-2026-40347 (python-multipart affected by Denial of Service via large multipart preamble or e) +2 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: `python-multipart>=0.0.6` allows installation of versions affected by multipart parsing denial-of-service issues unless a patched version is explicitly enforced. This is especially dangerous in a FastAPI stack because multipart parsers process attacker-controlled request bodies, enabling resource exhaustion through crafted uploads.

Known Vulnerable Dependency: pydantic — 3 advisory(ies): CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.)

High

• Category: Supply Chain
• Confidence: 79% confidence
• Finding: The Pydantic dependency is specified broadly enough that vulnerable versions may be selected unless resolution is tightly controlled elsewhere. Since Pydantic underpins request/data validation, denial-of-service or parsing flaws can be triggered broadly across API endpoints that consume untrusted input.

Known Vulnerable Dependency: pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: The Pillow requirement permits versions that may include known vulnerabilities, and image-processing libraries have a long history of exploitable parser flaws and denial-of-service conditions. In this stack, Pillow is especially concerning because uploaded or remote user-supplied images are a common attack vector.

Known Vulnerable Dependency: x402 — 1 advisory(ies): GHSA-qr2g-p6q7-w82m (x402 SDK Security Advisory)

High

• Category: Supply Chain
• Confidence: 81% confidence
• Finding: The `x402` dependency is associated with a published security advisory, and the broad version spec does not demonstrate exclusion of affected versions. Because it appears to be a payment or protocol SDK, compromise could affect integrity of transaction-related flows or trust decisions.

Known Vulnerable Dependency: web3 — 1 advisory(ies): CVE-2026-40072 (web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling)

Low

• Category: Supply Chain
• Confidence: 70% confidence
• Finding: The `web3>=6.0.0` spec may include versions affected by the cited SSRF issue depending on the exact vulnerable range, and the requirement does not cap or pin to a known safe version. In a web3-enabled application, SSRF can be serious if attacker-controlled offchain lookup URLs are reachable from privileged network locations.

Static analysis

No suspicious patterns detected.