Security audit

UK Landlord Compliance Docs

Security checks for vulnerabilities and agentic risk

Overview

This is a legal-document drafting skill with high-stakes subject matter, but it is instruction-only, scoped to England in the runtime instructions, and does not request code execution, credentials, persistence, or hidden access.

Install only if you understand this is a drafting aid for English landlord compliance, not legal advice. Have a qualified English housing solicitor or regulated housing professional review any notice, agreement, or possession step before use, verify current prescribed forms and commencement rules, and avoid entering unnecessary tenant personal data.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill offers to generate legally significant eviction notices and landlord compliance documents that users may rely on directly, but the README only gives a brief generic disclaimer rather than strong, repeated warnings to verify jurisdiction, current law, factual predicates, prescribed forms, and service requirements before use. In this context, incorrect or outdated output can cause invalid notices, unlawful eviction attempts, regulatory breaches, financial penalties, and tenant harm, making the lack of robust verification guidance a real safety issue.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill description is broad enough to activate on general landlord/legal queries, not just narrow document generation. That can cause the assistant to route users into a highly specialized legal-compliance skill prematurely, increasing the chance of overconfident legal guidance, jurisdiction mismatch, or inappropriate template generation in situations requiring tailored advice.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The interaction modes use generic scenario descriptions like eviction help, compliance checks, and document review without strong gating conditions. In practice this broadens autonomous triggering and may pull in the skill for ambiguous tenant-landlord disputes or legal strategy questions where incomplete or outdated guidance could materially affect users' rights and obligations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The listing promotes generation of legally significant eviction, possession, and compliance documents as if they are ready for use, but does not clearly require solicitor or qualified legal review. In this context, inaccurate or overconfident outputs could cause unlawful eviction attempts, invalid notices, loss of possession claims, financial penalties, or serious harm to tenants' rights, making the omission materially dangerous.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The skill is labeled for 'UK landlords' while the substance refers to English tenancy law, including England-specific reforms and procedures. That mismatch can cause landlords in Scotland, Wales, or Northern Ireland to rely on incorrect legal workflows or documents, potentially leading to unlawful notices, compliance failures, and tenant-rights violations.

Static analysis

No suspicious patterns detected.