T09 · Insecure Skill Coding Practices
Warning
- Location
prompts/01-client-acquisition-campaigns.md:93- Finding
Legal Inquiry Data May Be Reused for Advertising Without Explicit Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
Business Entity Disputes Kit
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Nevada legal-marketing prompt kit, but it includes under-scoped use of legal inquiry data for ad audiences and sample copy that may mislead users about bar-compliant attorney advertising.
Review this skill carefully before installing if you handle real law-firm marketing. Use it only for Nevada-targeted work reviewed by a Nevada attorney, remove unsupported comparative or superiority claims before publication, and do not use client, former-client, or prospective-client inquiry records for ad audiences unless the firm has documented purpose-specific consent and privacy/legal approval.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Claiming that attorneys who practice in Business Court 'have a procedural advantage' over general attorneys is an explicit superiority claim about lawyer quality or effectiveness. In attorney advertising, this is especially dangerous because it implies better outcomes or special advantage without objective substantiation, increasing bar-disciplinary and deceptive-marketing exposure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The prompt instructs the model to produce content that must comply with Nevada-specific rules, effectively forcing a jurisdictional locale without any explicit user choice or gating language in the skill file itself. Under the policy, language or locale constraints should either be opt-in or clearly documented as justified region-specific behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This section hardcodes Nevada RPC compliance and Nevada county targeting, which imposes a locale/jurisdiction constraint in natural language. Although the content is Nevada-themed, the file should explicitly state that the prompt is only to be used for Nevada matters or after the user confirms that jurisdiction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The prompt directs the model to write sequences compliant with Nevada RPC rules and grounded in Nevada law, but it does not include an explicit opt-in or validation that the attorney and audience are Nevada-specific. That creates a natural-language locale-policy issue because a fixed jurisdiction is enforced without documented confirmation in the prompt text.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill says content must comply with Nevada attorney advertising rules, but the embedded exemplar Q&As include comparative and superiority-style claims such as 'stronger than many other states' and 'procedural advantage.' Because downstream users may copy these exemplars verbatim, the prompt can induce generation of potentially non-compliant legal advertising and create regulatory, ethics, and misrepresentation risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This line uses comparative language suggesting Nevada's director-liability standard is 'stronger than many other states.' Even if legally arguable, presenting it as marketing copy risks creating an unjustified comparative claim in attorney advertising, especially without context, citation nuance, or jurisdiction-specific compliance review.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The prompt states Nevada LLC fiduciary-duty rules are 'different from Delaware' in a way that can be used as promotional comparative copy. In legal advertising, comparative jurisdictional claims may mislead non-lawyers or oversimplify nuanced doctrine, increasing ethics and consumer-protection risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This sample claims Nevada allows broader fiduciary-duty elimination than Delaware, which is comparative positioning embedded in marketing content. Such claims can be overgeneralized, may become outdated, and can function as an implied superiority statement to attract clients.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The phrase that Nevada applies a strong presumption against veil piercing and imposes a heavier burden than most states is comparative superiority framing in attorney marketing. This can encourage misleading simplification of a fact-intensive doctrine and may violate advertising standards that prohibit unjustified comparisons.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Saying the fraudulent-transfer limitations period is longer than many states introduces a comparative marketing claim rather than a strictly factual Nevada-law explanation. In a legal-services advertising context, that comparison can mislead readers about remedy availability and encourage non-compliant promotional messaging.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The statement that Nevada requires a higher deadlock-dissolution standard than many other states is comparative and promotional. In this skill's legal-marketing context, that language can be reproduced as attorney advertising and create ethics risk through oversimplification or unjustified comparison.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The content calendar is presented as compliant, yet several entries use persuasive or directive framing rather than neutral informational language, including statements that imply a recommended legal position. In a legal-marketing skill, this can normalize misleading or ethically risky ad copy and expose attorneys or users to bar advertising violations.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Template 16 — Communication complaint, de-escalate professionally Template 17 — Outcome dissatisfaction (no details, no admission) Template 18 — Fee concern, professional response Template 19 — Apparent case of mistaken identity (no confirmation of representation) **Competitive/Comparison Reviews (1 template)** Template 20 — "I called 3 firms and chose them because..." gracious acknowledgment
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The phrase 'It should' in reference to fiduciary-duty elimination steers the reader toward a specific legal position and reads more like advice or advocacy than neutral educational content. While less severe than the explicit comparative claims, it still undermines the prompt's stated compliance posture and can lead to risky marketing output.
- Content
Static analysis
No suspicious patterns detected.