One missed deadline ends a career. caseclaw makes sure it never happens. Point it at a matter and it auto-calculates every filing deadline from 600+ court rule sets. Throw a new client name at it and it checks conflicts against your entire case history in under a second. Start typing and it's already timing your work in six-minute increments. No browser tabs. No clunky SaaS dashboards. No $500/seat enterprise contracts. Just one command and the peace of mind that nothing is slipping through.

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:41 PM UTC
• Version: 1.0.0

Overview

This looks like a coherent legal case-management skill, but it installs an unaudited third-party CLI that may process confidential legal data and send some data to external services.

Review the `caseclaw` Homebrew tap, source, release provenance, and privacy/security terms before installing. Use an isolated environment or test data until you trust the binary, and treat Pro/Firm features plus email, Slack, and calendar alerts as external disclosure paths for client and matter metadata.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Executable Installation from a Mutable Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"🔱","requires":{"bins":["caseclaw"]},"install":[{"id":"brew","kind":"brew","formula":"legal-tools/tap/caseclaw","bins":["caseclaw"],"label":"Install caseclaw (brew)"}]}}

Technical Analysis

The skill instructs the host environment to install the caseclaw executable from the external Homebrew formula legal-tools/tap/caseclaw. The dependency is referenced through a mutable package name without an immutable source commit, fixed package version, checksum, or cryptographic signature recorded in the audited project.

Neither the Homebrew formula nor the executable's source is included in the project, which contains only SKILL.md and _meta.json. Therefore, the behavior and integrity of the code ultimately executed as caseclaw cannot be verified from this artifact. A future update to the tap, compromise of its publishing account or repository, or compromise of an upstream release could change the installed payload after this skill has been reviewed.

This is a supply-chain weakness rather than evidence that the current external package is malicious.

Attack Path

1. An attacker compromises the legal-tools/tap repository, its publishing credentials, the referenced formula, or an upstream artifact used by that formula.
2. The attacker changes the formula or upstream release so that it installs a malicious caseclaw executable.
3. A user loads or installs the skill in an environment where caseclaw is not already available.
4. The skill's installation metadata causes Homebrew to resolve the mutable legal-tools/tap/caseclaw formula.
5. Because this project specifies no trusted version or expected digest, the modified package may be accepted and installed without detection by the skill.
6. The user later in ...[truncated 1120 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, immutable release rather than relying solely on a mutable Homebrew formula name.
2. Record and verify a SHA-256 digest or a trusted cryptographic signature for the downloaded artifact before installation.
3. Pin the Homebrew tap or formula source to an immutable commit and ensure that the formula itself verifies the integrity of its upstream archive.
4. Include the formula and executable source in the auditable package, or provide reproducible-build documentation that allows reviewers to map the installed binary to reviewed source.
5. Protect release and tap publishing workflows with multi-factor authentication, least-privilege tokens, protected branches, mandatory review, signed tags, and provenance attestations.
6. Fail closed if signature, checksum, provenance, package version, or source verification does not match the approved release.
7. Display the exact package version and source to the user and require explicit confirmation before installing an executable that will process confidential legal data.
8. Run the executable with least privilege and restrict its filesystem and network access where practical.
9. Independently review the external formula and executable before treating the package's documented security, storage, or network-processing claims as verified.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill prominently markets local-first handling, but the alerting and Pro/Firm API-backed features introduce transmission of sensitive legal matter data to email, Slack, calendar providers, and remote processing without an equally prominent warning at the point those commands are introduced. In a legal context, even metadata such as client names, matter titles, deadlines, and court information can be highly sensitive, so users may disclose protected information without informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md

# 1. Run conflict check
caseclaw conflict check "New Client LLC" "Opposing Party Inc"

# 2. Create matter
caseclaw matter new --name "NewClient v. Opposing" --type litigation --court SDNY

# 3. Auto-generate deadlines

Static analysis

No suspicious patterns detected.