the ediscovery claw

• Outcome: Pass
• Latest audit: May 28, 2026 at 7:29 AM UTC
• Version:
  1.0.0

Overview

This is a coherent e-discovery helper skill that installs and documents a local legal-document processing CLI, but users should treat its data access and external binary install carefully.

Before installing, verify the legal-tools/tap/edisclaw Homebrew formula and publisher. Use the skill only for authorized legal matters, limit ingestion to approved custodians and date/file scopes, review any Pro/Litigation network behavior, protect ~/.edisclaw/, and clean up retained ESI when no longer required.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill encourages ingestion of highly sensitive sources such as PST mailboxes and Google Drive without any explicit warning about privacy scope, privileged material, third-party data, or the risk of over-collection. In an e-discovery context, users may assume the workflow is legally safe by default, which increases the chance of accidentally collecting confidential or out-of-scope data and exposing it to downstream processing features.

VirusTotal

64/64 vendors flagged this skill as clean.