Security audit

Legal Intake Agent

Security checks for vulnerabilities and agentic risk

Overview

This legal intake skill is not plainly malicious, but it needs Review because it handles sensitive legal data and external bookings while relying on under-scoped setup and safety claims.

Review this carefully before installing in a real law-firm workflow. Pin and verify ThumbGate, fix the skill identifier mismatch, restrict third-party integrations to least privilege, require human confirmation before bookings, and do not rely on the advertised legal-safety blocking until deterministic controls and attorney-approved policies are in place.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: setup-guide.md:3
Finding: Unpinned Third-Party Package Execution Through npx
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:2
Finding: Mismatched Skill Identifier May Load an Unreviewed Artifact
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:14
Finding: Safety-Critical Legal Intake Controls Are Specified Only as Prose
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly uses an 'Adverse Parties' Google Sheet for conflict checks but provides no safeguards for handling highly sensitive names and matter-related data. In a legal-intake context, exposing or misrouting this information can create confidentiality breaches, privacy violations, and ethical issues for the law firm, so the omission is security-relevant rather than merely documentation-related.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The setup guide instructs users to execute npx thumbgate init --agent openclaw without pinning a specific package version. This creates a supply-chain risk because future package updates, account compromise, or dependency hijacking could cause users to fetch and run unreviewed code during installation. In a legal-intake context, compromise could expose sensitive client intake and conflict-check workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guide recommends sending intake data to third-party services such as ElevenLabs, Make.com, and legal CRMs without any warning about confidentiality, consent, retention, or cross-system data exposure. Because this skill handles law-firm intake and conflict-check information, the data may include highly sensitive personal details or adversarial party names, making undisclosed onward transfer especially risky from both security and privacy perspectives.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest says the skill performs preliminary conflict-of-interest checks, which implies identifying and flagging potential conflicts. But the guide instructs users to verify that ThumbGate 'blocks the intake' when a conflicted party is detected, indicating the implemented behavior is outright refusal/blocking rather than a preliminary check workflow. This is an intent-level mismatch in the documentation about what the skill actually does during conflict handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill states that it books consultations directly into Clio, MyCase, or Google Calendar without warning about automatic writes to third-party systems. In this context, an agent that can create or modify records without clear authorization boundaries can cause unauthorized bookings, data integrity issues, accidental disclosure through calendar metadata, and operational disruption.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.