律师全案攻防实战推演

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:17 AM UTC
• Version: 3.0.0

Overview

This is a coherent Chinese legal-workflow skill with a disclosed local Markdown-to-DOCX export utility, but users should handle client and case details carefully.

Before installing, confirm this skill is appropriate for Chinese civil/commercial legal work. Treat client identities, communications, evidence, litigation strategy, and case files as confidential; redact unnecessary sensitive data and run the export script only on specific working folders, preferably in a virtual environment with a reviewed pinned python-docx dependency.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/markdown_to_docx.py:18

Finding

Unpinned Third-Party Dependency Installation Guidance

Content

View full analysis

Vulnerability Details

File Location: scripts/markdown_to_docx.py, lines 18–23
Vulnerability Type: Unpinned third-party dependency and insufficient supply-chain controls
Risk Level: Medium

Vulnerable Code

python

try:
    from docx import Document
    from docx.shared import Pt, Cm, RGBColor
    from docx.enum.text import WD_ALIGN_PARAGRAPH
    from docx.oxml.ns import qn
except ImportError:
    print("缺少依赖：python-docx")
    print("请运行：pip install python-docx")
    sys.exit(1)

Technical Analysis

If the docx module is unavailable, the script instructs the user to install python-docx directly from the package index without specifying a reviewed version, verifying package hashes, using a lockfile, or requiring an isolated environment.

The package name is consistent with the legitimate dependency, and the script neither performs the installation automatically nor specifies a suspicious package index. Nevertheless, following this instruction resolves the latest available package and its transitive dependencies at installation time. This makes installation non-reproducible and exposes users to future package compromise, malicious dependency substitution, or incompatible releases.

Python packages may run code during installation, and imported packages execute module-level code at runtime. A compromised package or dependency could therefore execute with the permissions of the user performing the installation or running the converter.

Attack Path

1. A user runs scripts/markdown_to_docx.py on a system where python-docx is not installed.
2. The import fails, and the script displays the instruction pip install python-docx.
3. The user follows the instruction without a pinned version, verified hashes, or a trusted lockfile.
4. The package manager retrieves the currently resolved package and transitive dependencies from its configured index.
5. If a future release, transitiv ...[truncated 822 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a dependency manifest containing a reviewed, exact python-docx version.

2. Generate and verify cryptographic hashes for the package and all transitive dependencies.

3. Install dependencies with hash enforcement, for example:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Recommend installation inside a dedicated virtual environment rather than the system Python environment.

5. Use an organization-controlled package mirror or explicitly documented trusted index where appropriate.

6. Add automated dependency vulnerability and integrity scanning to the release process.

7. Replace the unpinned installation message with instructions that reference the reviewed dependency file, such as:

   python

   except ImportError:
       print("Missing dependency. Install reviewed packages in an isolated environment:")
       print("python -m pip install --require-hashes -r requirements.txt")
       sys.exit(1)
   

8. Regularly review and deliberately update pinned versions and hashes rather than allowing implicit upgrades.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a legal-analysis skill for lawyers handling civil/commercial disputes, including case intake, claim construction, defense analysis, document audit, trial rehearsal, and judgment prediction. The supplied code does none of that. Instead, it is a document export/conversion script: it reads Markdown files, parses basic Markdown syntax, creates formatted DOCX files, adds page numbers, scans directories recursively, and optionally bundles outputs into a ZIP archive. This is a materially different primary purpose and introduces undeclared file-processing/export capabilities unrelated to the declared legal reasoning workflow. Therefore the description does not accurately represent the code's actual behavior.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

> 头像：`assets/avatar.png`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md

> 头像：`assets/avatar.png`

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description and the body of the skill are written as a China-specific, Chinese-language workflow for "民商事律师", with trigger phrases, headings, outputs, and user guidance all presented only in Chinese. There is no indication that the user may choose another language or locale, so the skill effectively imposes a specific language/locale by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This worksheet explicitly collects highly sensitive legal matter data, including case details, client communications, litigation strategy, and archival references, but provides no privacy, confidentiality, minimization, or retention guidance. In a lawyer-facing skill, that omission increases the chance users will paste regulated personal data, privileged communications, or confidential case facts into broadly stored or shared systems, creating confidentiality, compliance, and professional-responsibility risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill manifest describes a six-phase civil/commercial lawyer workbench for case analysis, pleading review, trial preparation, and judgment prediction. This file instead implements a generic Markdown-to-DOCX batch converter for local documents, which is a document export utility rather than legal reasoning or strategy functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest justifies legal analysis and litigation-support workflows, but this code adds a broad filesystem utility: recursively walking arbitrary directories for Markdown files, converting them, and optionally packaging outputs into a ZIP archive. Those capabilities are not obviously required for a lawyer-case-strategy workbench as described, especially when they operate over arbitrary user-supplied paths.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file is entirely written as mandatory procedural guidance in Chinese for using the skill, and nowhere offers an alternative language, localization choice, or user opt-in. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. This file presents all instructions and guidance only in Chinese, with no user opt-in, alternative language option, or statement that the skill is limited to a Chinese-language or China-specific legal context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring says it provides document export capability for the '建工实务·裁决视角系列技能', while the manifest for this skill is 'lawyer-case-strategist' focused on民商事 case strategy under the Nine-Step Method. This is an active documentation-to-context contradiction suggesting the file was copied from another skill or repurposed without aligning its intent documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.