Lawyer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:15 PM UTC
• Version: 1.0.2

Overview

The skill is a coherent local legal assistant, but it automatically keeps and modifies sensitive legal, contact, project, and finance notes without per-action approval.

Install only if you are comfortable with a local legal memory that updates automatically. Review the files under ~/Clawic/data/lawyer/ and the shared contacts, projects, and finances paths regularly, and consider requiring your agent to preview and confirm writes before saving sensitive legal or personal information. Do not treat the stored output as privileged legal advice.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (19)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 55% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · disputes.md (reported line 96)May include surrounding context.

md

## Responding To A Demand

Acknowledge receipt and buy time — a holding response that says the matter is being investigated and a substantive reply will follow by a stated date is standard and costs nothing. Do not admit, do not apologise in terms that concede liability, and do not let an engineer or an account manager reply directly.

Then run the same four-question assessment from the other side, plus: check the indemnity chain (does a supplier owe this?), check insurance, and check whether the claim's own notice requirements were met.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 64)May include surrounding context.

md

When the user pastes a contract, a runbook or an export to save, replace each secret value before writing and leave the pointer visible: `Account: <1password:Finance/Bank/operating>`. Say in one line that you did it.

In this domain — **not secrets, keep them**: registered company names, company and VAT registration numbers, registered addresses, trademark and patent application and registration numbers and classes, case and docket numbers, matter references, court and registry names, contract titles and dates, clause text, cap and fee amounts with currency, insurance policy numbers and limits, counsel and firm names, filing receipt numbers. **Secrets, strip them**: passwords and portal logins for registries, courts, e-signature tools and data rooms; API keys and webhook tokens; data-room or document share links that carry an access token; bank account, IBAN, routing and card numbers in payment schedules; national identity numbers (SSN, NI, passport, tax id of an individual); full dates of birth of third parties; scans or images of identity documents; private keys, escrow release codes and one-time codes.

Third-party personal data is not a secret in this scheme and is still not stored here: record that the dataset exists, its categories and who controls it.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill tells the agent to consult shared memory and prior clause artifacts before proposing a position, and frames prior customer concessions as reusable negotiation precedent. In the legal context, that creates a direct risk that one client's negotiated terms or strategy influence outputs for another client, leaking confidential business positions across matters.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction explicitly directs the agent to write accepted clause language, dates, counterparties, and rejected positions into persistent local files, but provides no consent, retention limit, or matter-scoping control. In a legal workflow, this can store sensitive negotiation history and client-specific terms beyond the immediate task, creating privacy, confidentiality, and cross-matter exposure risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Recording exact accepted wording, who accepted it, rejected alternatives, and summaries into shared memory/artifacts preserves highly sensitive legal negotiation data in a form that is easy to retrieve and reuse. Because this skill is for lawyer-like work involving contracts, disputes, employment, and privacy matters, the stored data may include privileged, confidential, or strategically valuable information whose later exposure could materially harm clients.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to write to persistent memory and artifact files in the same turn after compliance work, without requiring explicit user confirmation or distinguishing between analysis and state-changing actions. In an agent environment with filesystem/tool access, this can cause unauthorized modification of legal records, compliance calendars, or matter logs based solely on document review, creating integrity and privacy risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly instructs the agent to write dispute, contacts, and budget information into multiple persistent shared/local files without requiring confirmation, scoping, or safeguards around sensitive legal data. In a legal-disputes context, this can cause unauthorized modification of user records, accidental disclosure of confidential matter details, and durable storage of sensitive litigation metadata in shared repositories.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

|---|---|
| Commingled funds — personal expenses on the company account | Separate accounts, documented expense policy, reimbursements not direct payments |
| Undercapitalisation at formation relative to the risks taken | Fund the entity properly, and carry insurance |
| No corporate formalities — no minutes, no consents, no records | The governance discipline below |
| Contracts signed personally or in a trade name | Correct entity and signature block every time (SKILL.md Rule 7) |
| The company used to perpetrate a fraud or evade an obligation | No fix; this is the core case |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · entity.md (reported line 71)May include surrounding context.

md

|---|---|
| Commingled funds — personal expenses on the company account | Separate accounts, documented expense policy, reimbursements not direct payments |
| Undercapitalisation at formation relative to the risks taken | Fund the entity properly, and carry insurance |
| No corporate formalities — no minutes, no consents, no records | The governance discipline below |
| Contracts signed personally or in a trade name | Correct entity and signature block every time (SKILL.md Rule 7) |
| The company used to perpetrate a fraud or evade an obligation | No fix; this is the core case |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · ip.md (reported line 63)May include surrounding context.

md

| Employee, in the course of employment | Employer, in most common-law systems | Confirm in the contract; some civil-law systems need express assignment or extra compensation for inventions |
| Contractor or agency | **The contractor**, unless there is a written assignment | Present-tense assignment plus moral-rights waiver, tied to payment (`agreements.md`) |
| Founder, before incorporation | The founder personally | Assign into the company at formation — the single most common gap found in diligence (`diligence.md`) |
| Joint authors | Jointly, with rules that differ sharply: US co-owners can each license non-exclusively without consent; UK and most of Europe require consent | Agree ownership in writing before the collaboration |
| Commissioned agency work | Usually the agency | Check every logo and every website; brands routinely do not own their own marks |

US "work made for hire" for a non-employee applies only to nine enumerated categories plus a signed writing, and software is not one of them. Rely on assignment language, not on the phrase.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to write negotiation results into local memory files (memory.md, including positions, contracts, due dates, and pain points) without any user-facing confirmation or warning. This creates an unauthorized persistent state change risk: sensitive legal and counterparty data could be stored locally, retained across sessions, or exposed to later tasks without the user's informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs the agent to update local tracking files such as memory.md and subscriptions.md as part of normal operation, but it provides no guardrails around confirming the write scope, preserving existing data, or handling mistakes. In a legal workflow, these files may contain sensitive contract, payment, and operational deadline data, so unreviewed writes or deletions can corrupt records or expose confidential information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to write served notice details, including recipient, method, dates, and proof of delivery, into artifact files without warning about sensitivity or retention controls. In the legal context, those records can include confidential contract metadata, counterparty identities, and evidence relevant to disputes, so automatic storage increases the risk of unauthorized disclosure, over-retention, or accidental propagation of privileged material.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to read persistent memory containing open matters and jurisdiction data before answering, but provides no user-consent, minimization, or sensitivity guardrails. In a legal-assistance context, these files are likely to contain highly sensitive personal and case information, so automatic access increases the risk of unnecessary exposure, over-collection, and cross-matter leakage.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Natural-language instructions to read user-specific case details from memory before answering create a semantic data-retention and data-mixing risk even without code execution. In this context, prior legal matters and jurisdiction notes may influence responses unnecessarily or leak into later sessions, especially when the current request does not require those details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill directs the agent to persist complaint letters, chronologies, deposit reports, contract rows, deadlines, and other personal correspondence into local memory/artifact stores without warning about privacy impact or validating necessity. Because this is legal/personal-consumer content, the stored artifacts may include intimate financial, housing, employment, and dispute details that could later be exposed, reused in the wrong context, or retained longer than intended.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction to record detailed personal matters, deadlines, amounts at stake, correspondence, and contract information into persistent stores creates a clear semantic collection and leakage risk. In a lawyer skill, this data is especially sensitive and cumulative, so centralized retention can amplify harm from later unauthorized access, accidental retrieval, or overbroad reuse across unrelated user interactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to write to local portfolio, filing, and artifact files after an IP action, but it does not require confirming that the user wants those files modified first. In an agent setting, this can cause unintended state changes, incorrect legal records, or persistence of sensitive business information without clear user authorization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill directs the agent to write contract metadata, deadlines, negotiation positions, and a new counterparty contact into persistent local and shared files after completing a review, but it does not require user confirmation, validation, or any guardrails around what may be stored. In a legal workflow, this can cause unintended persistence of sensitive or inaccurate information, including confidential deal terms or personal contact data, and can pollute shared records that later decisions rely on.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.