Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Security audit
defense draft
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed legal document-drafting helper that runs locally, but users should treat its output as a draft framework rather than legal advice.
Use this only to organize questions and draft a framework for attorney review. Do not file generated text without confirming the deadline, court rules, jurisdiction-specific formatting, service requirements, and defense preservation issues with qualified local counsel.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description enumerates only Chinese trigger phrases, which makes activation dependent on a specific language. Under the policy, language constraints should either offer user choice or be clearly documented as a justified region- or locale-specific limitation, which is not stated here.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The description includes broad trigger phrases such as 'wants to draft a response to a lawsuit' and multiple everyday expressions, which can cause the skill to activate for general legal-help requests beyond a narrowly defined drafting task. In a legal-context skill, overbroad activation increases the chance of the agent invoking specialized legal-document generation when the user may need jurisdiction-specific guidance, disclaimers, or a narrower capability boundary.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The trigger list includes broad phrases such as "怎么应诉", "收到起诉书", and "我要答辩", which can arise in general conversation or many legal-support contexts without clearly indicating this exact skill should activate. The manifest does not provide narrowing conditions, exclusions, or negative examples to distinguish when the skill should and should not run.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
All listed triggers are Chinese phrases, and the manifest provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-language or region-specific legal context. This creates a natural-language policy concern because the skill appears to enforce a specific language/locale without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file offers detailed pleading and filing templates, checklists, and response options that could be used directly in litigation, yet the only disclaimer is brief and generic. Without prominent warnings about deadlines, waiver of defenses, jurisdiction-specific rules, and the risk of losing legal rights if used incorrectly, users may rely on the templates in a way that causes material procedural harm.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest limits the skill to generating civil answer/defense document frameworks in response to complaints. This file goes further by providing a counterclaim section and separate counterclaim framework, which are affirmative claims against the plaintiff rather than a defense-only response. It also includes a standalone motion to dismiss template, which is a different procedural filing than an answer/defense framework.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest describes assistance for 答辩状/答辩书 and responding to a complaint, framed as defense document frameworks. A motion to dismiss is a distinct pre-answer procedural motion and not merely an answer framework implementation detail. Including a comprehensive Rule 12(b) template broadens the skill beyond its declared purpose.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
A counterclaim requires drafting affirmative causes of action, jurisdictional allegations, and prayer for relief as if composing a complaint. That goes beyond a defense-only framework and introduces claim-assertion capabilities not described in the manifest. This is a substantive scope expansion, not a minor drafting detail.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script formats a document that closely resembles a file-ready pleading and includes only a general disclaimer, but it does not clearly warn that the content is jurisdiction-specific, may be procedurally incorrect, and should not be filed or relied on without attorney review. In a legal-defense drafting skill, users facing real deadlines may over-trust the generated output and submit defective pleadings, risking waiver of defenses, default, or other adverse case outcomes.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The usage section provides only Chinese example requests, reinforcing that the skill expects a single language. Because the file does not explicitly present this as an optional or justified locale restriction, it can be read as a policy-violating forced language requirement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The natural-language invocation guidance prominently lists Chinese trigger phrases for activation, but does not indicate that users may interact in other languages or choose their preferred language. That can be read as a language-specific policy constraint without explicit user opt-in or justification.
- Content