Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent contract risk checker, but it asks users to paste sensitive contracts and applies UK legal standards without enough jurisdiction or privacy safeguards.
Install only if you want UK-oriented contract risk flagging. Do not paste unnecessary personal data, trade secrets, privileged material, or commercially sensitive details unless you are comfortable with how your agent environment handles that content. For non-UK contracts or high-value/complex agreements, treat the output as a checklist and consult qualified local counsel.
The README states legal checks against UCTA 1977 and the Consumer Rights Act 2015 without clearly limiting the skill to UK/England & Wales contexts or prompting for jurisdiction. That can cause users in other regions to rely on inapplicable legal standards, producing misleading risk assessments in a legal-review workflow where accuracy is safety-critical.
Presenting 'Jurisdiction outside England & Wales' as an always-flagged red flag implies a universal rule rather than a UK-specific preference. In contract review, this can bias users into rejecting valid agreements or misunderstanding cross-border arrangements, especially when the skill offers negotiation language that may be acted on directly.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Penalty clauses
- Missing GDPR terms
- One-sided termination
- Assignment without consent
**Missing clause warnings:**
- Limitation of liability
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Penalty clauses
- Missing GDPR terms
- One-sided termination
- Assignment without consent
**Missing clause warnings:**
- Limitation of liability
The skill is user-invocable and described in very broad terms ('review contracts', 'understand terms', 'negotiate better conditions'), which can cause it to be triggered for ordinary legal-help requests without clear scoping or jurisdiction checks. In a legal-adjacent skill, overbroad routing increases the chance users receive contract-specific, UK-framed guidance when they may need different expertise, narrower handling, or stronger warnings.
The skill explicitly invites users to paste full contract text, which commonly contains sensitive personal, financial, and commercially confidential information, but provides no privacy, retention, or confidentiality warning. This creates a realistic risk that users will disclose regulated or proprietary data without understanding handling limits, especially because the marketing frames the tool as a practical substitute for professional review.
The listing presents checks against UCTA 1977, the Consumer Rights Act 2015, and the Late Payment of Commercial Debts Act 1998 as built-in outputs without clearly limiting the service to UK-law contracts or requiring jurisdiction confirmation. Users dealing with non-UK agreements could rely on inapplicable legal standards, leading to materially wrong risk assessments and unsafe negotiation decisions.
The skill instructs the model to default to UK English and UK legal principles unless the user specifies otherwise, which can silently apply the wrong legal framework. For cross-border or non-UK users, this may produce misleading compliance and enforceability assessments that appear authoritative despite the disclaimer.
No suspicious patterns detected.