Security audit

法眼-全能法律专家顾问

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed PRC-law reference and drafting skill with broad legal workflows, but I found no hidden execution, persistence, credential access, exfiltration, or destructive behavior.

Use this skill only as preliminary PRC-law guidance. Verify current statutes, cases, deadlines, and filing requirements with an authoritative source or licensed lawyer, and use placeholders or redactions for ID numbers, addresses, phone numbers, and third-party details until they are truly needed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (79)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill promises concrete legal capabilities such as contract review pipelines, litigation drafting, legal validity checks, limitation-period verification, case retrieval, and routing logic, but the file only contains descriptive instructions and references rather than enforceable implementation. In a legal-assistance context, this mismatch is dangerous because users may rely on the claimed safeguards and analysis depth for high-stakes decisions, leading to incorrect legal action, missed deadlines, or false confidence about compliance and rights.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes broad, common phrases such as everyday legal or dispute-related expressions, making unintended invocation likely in normal conversation. In a legal skill, accidental activation can steer users into authoritative-sounding legal workflows without adequate context, increasing the chance of overcollection of sensitive facts, irrelevant legal guidance, or misplaced reliance on the tool.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The fallback route states that any legal-related question can trigger the generic legal Q&A chain, which is effectively unconstrained. This creates a broad catch-all that can activate on ambiguous input and present the system as competent across all legal domains, despite the document not implementing the promised safeguards or bounded domain checks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Several route triggers rely on vague everyday phrases like asking how to complain, sue, or defend rights, without enough context to distinguish casual discussion from a request for formal legal workflow execution. Because the skill presents itself as an expert legal advisor, these loose triggers increase the risk of accidental routing into sensitive legal guidance where nuance, jurisdiction, and deadlines matter.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language. This markdown file contains only Chinese content and does not state that the skill is China-specific or provide an opt-in or alternative language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire skill file is written in Chinese and provides no indication that users may choose another language or that the skill is intentionally limited to Chinese-language contract review. Under the policy, a language constraint without user opt-in or clear justification can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire skill file is written in Chinese and provides no indication that users may choose another language or that the skill is intentionally limited to Chinese-speaking or PRC-law contexts. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file uses Chinese throughout and does not indicate that the user can choose another language or that the persona is intentionally limited to a Chinese-speaking or region-specific audience. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire persona file is written only in Chinese and presents the guidance as the default without any indication that users may choose another language or that the skill is intentionally limited to a Chinese-language or China-specific audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing guidance exclusively in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking region or audience. Under the policy, forcing a specific language without user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire persona guide is written in Chinese and presents all prompts and guidance only in that language. This can constitute a language/locale policy violation when no user opt-in, alternative language option, or explicit region-specific justification is provided.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger list contains broad phrases such as “合法吗 ” and “类似案例”, which can match many general legal or business queries without clear routing boundaries. In an agentic skill system, overbroad activation can cause the legal-advice workflow to engage in unintended contexts, increasing the chance of incorrect scope selection, inappropriate reliance on this SOP, or unsafe legal guidance being delivered without sufficient qualification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The title and the entire instruction set are written as a Chinese-only SOP, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The SOP states that steps must never be skipped, but later explicitly permits accelerated paths that omit required stages. In a legal-review workflow, this inconsistency can cause the agent to bypass fact-gathering, legal research, or due-diligence checks, leading to incomplete or unsound advice while still presenting the output as compliant with the full process.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file explicitly defines trigger keywords, and several listed phrases such as “帮我看合同”, “这个条款”, “协议”, and “签约” are broad enough to overlap with ordinary conversation or many non-skill-specific contexts. The file does not provide narrowing constraints, exclusion conditions, or negative examples to clarify when the skill should or should not activate.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document conflicts with the manifest's guarantee that the 7-step pipeline is mandatory and non-skippable by allowing fast-track variants that skip Step 6 or other steps. This creates policy drift between the declared behavior and actual operating instructions, which can mislead users and downstream systems into trusting a level of rigor that was not actually applied.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger list is broad enough to match many ordinary legal-themed user messages, which can cause the dispute-diagnosis SOP to activate when the user did not intend that workflow. In a legal skill, unintended activation is risky because it may steer users into premature dispute framing, collect unnecessary sensitive facts, or produce overconfident quasi-legal guidance in the wrong context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list includes broad, high-frequency terms such as “知识产权”, “版权”, “商业秘密”, and “域名”, which can match ordinary discussion rather than an explicit request for this SOP. In an agentic system, this increases the chance of unintended activation and legal-analysis behavior in the wrong context, potentially causing irrelevant guidance, privacy over-collection, or misrouting of user requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The fallback trigger conditions are extremely broad, including effectively any legal-related question that does not match other SOPs. In a legal-advice skill, this can cause over-activation of a generic path for high-stakes matters, increasing the chance of incomplete triage, missed specialist routing, or unsafe guidance on time-sensitive or jurisdiction-specific issues.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases include very common expressions such as “合法吗”, “可以吗”, and “合理吗”, which are likely to appear in ordinary conversation outside the intended boundary-check workflow. In an agent skill, overly broad routing can cause the model to invoke this SOP unexpectedly, leading to irrelevant legal judgments, incorrect escalation into rights-assertion workflows, or bypass of more suitable domain-specific handling.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases are broad enough to match many ordinary legal-help requests, which can cause this SOP to activate when the user did not specifically ask for case-law style research. In a legal assistant, misrouting into case search can produce overconfident or inapplicable guidance, especially because users may treat retrieved cases as predictive of their own outcome despite the disclaimer.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes broad, common phrases such as '起诉', '上诉', and '合法吗', which can plausibly appear in ordinary conversation and cause unintended activation of a high-impact legal workflow. In this skill, accidental activation is more dangerous because the workflow collects sensitive facts and may guide users toward legal drafting steps without clear confirmation of intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The SOP directs collection and generation of litigation documents containing highly sensitive personal data, including identity numbers, addresses, phone numbers, dates of birth, and case facts, but it does not require a privacy warning, minimization, or masking guidance. In the legal context this is especially risky because users may disclose third-party data and case-sensitive information that, if mishandled or over-collected, could create privacy, confidentiality, and compliance issues.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file is entirely framed as a Chinese-language legal template, beginning with a Chinese title and continuing throughout without any indication that language is optional or region-specific by design. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire skill file is written as a Chinese-only template and does not offer any language or locale choice to the user. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable unless the locale restriction is clearly documented and justified, which is not stated here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.