Security audit
Legal Intake Agent
Security checks for vulnerabilities and agentic risk
Overview
This legal intake skill is mostly coherent, but it asks law firms to route sensitive intake and conflict-check data through third-party tools without enough security, privacy, or access-control guidance.
Before installing this in a real law-firm workflow, treat all intake, conflict-list, and adverse-party data as sensitive. Only connect approved vendors, restrict Google Sheet sharing, minimize synced fields, configure least-privilege service accounts, define retention and audit logging, and have a qualified legal/compliance reviewer approve the workflow.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.