DeepLegal Chinese Contract

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:54 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed contract-review and document-generation helper, with manageable privacy and dependency cautions but no evidence of hidden execution, exfiltration, or persistence.

Before installing, be comfortable with the agent reading full contracts and creating local JSON/DOCX files that may contain confidential deal terms. Use an isolated environment for sensitive matters, pin and audit the Python dependencies, delete temporary input files after generation, and have qualified counsel verify legal outputs before relying on them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unbounded Third-Party Dependency Versions

Content

View full analysis

Vulnerability Details

File Location: scripts/requirements.txt:1-2; related installation guidance at scripts/docx_generator.py:32
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable dependency declarations:

text

python-docx>=1.1.0
lxml>=4.9.0

Related installation guidance:

python

Dependencies: pip install python-docx lxml

Technical Analysis

The project specifies only minimum dependency versions and does not impose upper bounds, exact version pins, integrity hashes, or a reviewed lock file. Consequently, separate installations can resolve to different package versions, including future releases that were not available during this audit.

The package names are legitimate and consistent with the declared DOCX-generation functionality. No evidence of typosquatting, dependency confusion, or a currently malicious package was identified. The risk arises from implicitly trusting any future release accepted by the broad version ranges.

Python dependencies can execute code during installation, import, and normal use. If a future compatible release is compromised, incorrectly published, or contains an exploitable regression, the project could consume it automatically without any source-code change.

Attack Path

1. An attacker compromises the publication process or maintainer account of a permitted dependency, or a future release introduces a security vulnerability.
2. The attacker publishes a version satisfying python-docx>=1.1.0 or lxml>=4.9.0.
3. A user installs the project dependencies without a lock file or hash verification.
4. The package resolver selects the affected release.
5. Attacker-controlled or vulnerable code executes during installation, import, or DOCX generation.

This path depends on a supply-chain compromise or vulnerable future release; the audited project does not itself retrieve remote payloads at runtime.

...[truncated 721 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace minimum-only constraints with exact versions that have been tested and reviewed:

   text

   python-docx==<reviewed-version>
   lxml==<reviewed-version>
   

2. Generate and commit a deterministic lock file covering direct and transitive dependencies.
3. Record SHA-256 hashes and install with hash verification, such as:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Use a controlled package index or repository mirror and explicitly configure trusted sources.
5. Run dependency vulnerability and license scanning in CI for every dependency update.
6. Review updates before changing pinned versions, then regenerate hashes and rerun DOCX-generation tests.
7. Install and run the generator in a least-privileged virtual environment or isolated container without unnecessary credentials or outbound network access.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code supports one narrow portion of the description: generating .docx files with track changes and comments for contract markup. However, the declared purpose describes a full legal counsel capability covering contract drafting, legal review, cross-border analysis, and jurisdiction-specific legal reasoning under PRC, US, and Hong Kong law. None of that substantive legal functionality appears in the code. The script simply reads JSON and renders a Word document in draft or review mode using python-docx and low-level OOXML edits. This is a material mismatch in primary purpose and implemented capabilities, even though the document-generation portion is accurately represented.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence

Finding

The skill instructs reading full contracts and related local resources and invoking a local script, but it declares no explicit tool scope or permissions boundary. In practice this can lead to broader-than-expected file access and weak least-privilege controls, especially because contract files are likely to contain highly sensitive legal and commercial information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases include a broad catch-all such as 'any contract-related task,' which can cause the skill to activate in situations beyond the user's intent. In a legal skill, accidental invocation is more dangerous because it may prompt sensitive document handling, legal-style advice, and file generation on confidential materials without sufficiently clear user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill mandates generating .docx files from user-supplied contract content but does not disclose that the content will be written to local files. Because contracts often contain trade secrets, personal data, deal terms, and privileged legal material, undisclosed local persistence materially increases confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · legal-reference.md (reported line 46)May include surrounding context.

md

- Burden shifting: once right holder establishes prima facie case (possession + similarity + access), alleged infringer must prove lawful source

- **Art. 12 - Internet-Specific Unfair Competition (互联网不正当竞争)**:
  - Inserting links or forcing redirects in others' network products without consent
  - Misleading or forcing users to modify, close, or uninstall others' products
  - Malicious incompatibility with others' network products
  - Other acts disrupting normal operation of others' network products/services

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document is framed around PRC, Hong Kong, and bilingual Chinese legal drafting guidance, including prescribed comment language in Chinese, but it does not state that this jurisdictional and language focus is optional or limited to users who need those locales. Under the policy rule for language or locale constraints, this can be a natural-language policy issue because the skill appears to impose a specific locale focus without explicit opt-in or justification in the file itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

In setup_document_styles, the script unconditionally sets East Asian fonts to SimSun and SimHei for all generated documents. This is a natural-language/locale policy concern because the file imposes a specific locale-oriented formatting choice without opt-in, and the script is not documented as a region-specific tool.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · contract-clauses.md (reported line 139)May include surrounding context.

English

text

Neither Party shall be liable for any failure or delay in performing its obligations under this Agreement to the extent that such failure or delay results from circumstances beyond the reasonable control of that Party, including but not limited to: acts of God, natural disasters, epidemics or pandemics, war, terrorism, civil unrest, government actions or sanctions, embargo, labor disputes, power failures, internet or telecommunications failures, or cyberattacks ("Force Majeure Event").

The affected Party shall: (a) promptly notify the other Party in writing of the Force Majeure Event and its expected duration (such notice to be given within [five (5)] business days of the occurrence); (b) use commercially reasonable efforts to mitigate the effects; and (c) resume performance as soon as reasonably practicable.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · contract-clauses.md (reported line 200)May include surrounding context.

English

text

Neither Party shall be liable for any failure or delay in performing its obligations under this Agreement to the extent that such failure or delay results from circumstances beyond the reasonable control of that Party, including but not limited to: acts of God, natural disasters, epidemics or pandemics, war, terrorism, civil unrest, government actions or sanctions, embargo, labor disputes, power failures, internet or telecommunications failures, or cyberattacks ("Force Majeure Event").

The affected Party shall: (a) promptly notify the other Party in writing of the Force Majeure Event and its expected duration (such notice to be given within [five (5)] business days of the occurrence); (b) use commercially reasonable efforts to mitigate the effects; and (c) resume performance as soon as reasonably practicable.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · contract-clauses.md (reported line 237)May include surrounding context.

English

text

Neither Party shall be liable for any failure or delay in performing its obligations under this Agreement to the extent that such failure or delay results from circumstances beyond the reasonable control of that Party, including but not limited to: acts of God, natural disasters, epidemics or pandemics, war, terrorism, civil unrest, government actions or sanctions, embargo, labor disputes, power failures, internet or telecommunications failures, or cyberattacks ("Force Majeure Event").

The affected Party shall: (a) promptly notify the other Party in writing of the Force Majeure Event and its expected duration (such notice to be given within [five (5)] business days of the occurrence); (b) use commercially reasonable efforts to mitigate the effects; and (c) resume performance as soon as reasonably practicable.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency specifier uses a lower-bound range instead of an exact version, which makes builds non-reproducible and can cause installation of unexpected or newly introduced vulnerable releases. In a legal document generation skill that processes untrusted contract files, this increases supply-chain uncertainty and makes it harder to verify whether XML/parsing-related fixes are actually present.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

python-docx>=1.1.0
lxml>=4.9.0

Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

python-docx has known historical advisories, including XXE-related issues, and the manifest does not pin a version, so there is no assurance that an affected release will not be installed. In a contract-review skill that may ingest externally supplied .docx files, XML entity handling flaws could expose local files or enable SSRF-like parser abuse depending on runtime configuration.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lxml dependency is also unpinned, so deployments may resolve to different versions over time, including versions with security regressions or incompatible parser behavior. Because this skill handles document/XML processing, dependency drift in a parser library is more security-relevant than in a non-parsing utility package.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text

python-docx>=1.1.0
lxml>=4.9.0

Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

lxml has a substantial advisory history and, without version pinning, the project cannot demonstrate that only patched releases are installed. Given that lxml is a core XML/HTML parser and this skill generates or may process document content, parser or sanitizer flaws can materially increase risk from crafted legal documents or embedded markup.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.