蒋道理｜撤三证据链与风险审核引擎（SJ-IRAC）

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:02 AM UTC
• Version: 3.0.1

Overview

This appears to be a real local legal document tool, but it has unsafe file-handling and local web UI controls that should be reviewed before installation.

Install only in a dedicated environment and use trusted case files. Keep the Web UI bound to 127.0.0.1, avoid exposing the desktop/web server to a network, pin/review dependencies before production use, and only use --organize-dir with a disposable output folder.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill executes multiple external binaries (pdftoppm, tesseract, soffice) and later launches a separate Python generator from a user-supplied --generator path. In an agent setting, this expands the trust boundary significantly: a caller can cause execution of unexpected local programs or malicious helper scripts, which is dangerous even though the purpose appears operational rather than overtly malicious.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: organize_evidence_package clears every file and subdirectory under a caller-controlled target_dir before repopulating it. Because --organize-dir is externally supplied and there is no safety boundary check against sensitive paths, misuse could wipe arbitrary directories accessible to the process.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The code deliberately strips or suppresses unfavorable evidence wording such as “时间不明” from submission-facing output. In a legal-evidence automation context, this is dangerous because it can materially misrepresent evidentiary weakness to downstream reviewers, creating deceptive output rather than a neutral transformation.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The code removes internal-risk and submission-warning language from outward-facing documents while still generating persuasive output. In this skill’s context—automating legal defense materials—suppressing risk disclosures increases the chance that weak, incomplete, or misleading evidence narratives are presented as stronger than they are.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas
openpyxl
python-docx
pypdf

• Confidence: 97% confidence
• Finding: The dependency list leaves pandas unpinned, so builds can resolve to different versions over time, including versions with newly introduced vulnerabilities or breaking behavior. In a security-sensitive skill that processes user-supplied documents, nondeterministic dependency resolution increases supply-chain and maintenance risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas
openpyxl
python-docx
pypdf
PyMuPDF

• Confidence: 97% confidence
• Finding: openpyxl is unpinned, which allows installation of arbitrary newer or older versions depending on environment state and resolver behavior. Because this package parses spreadsheet files, unpinned resolution can expose the skill to known parser bugs or future vulnerable releases without code changes.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas
openpyxl
python-docx
pypdf
PyMuPDF
PyYAML

• Confidence: 97% confidence
• Finding: python-docx is unpinned, making deployments non-reproducible and increasing the chance of silently pulling a vulnerable parser release. Since document-processing libraries often handle attacker-controlled files, version drift raises meaningful security exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas
openpyxl
python-docx
pypdf
PyMuPDF
PyYAML

• Confidence: 97% confidence
• Finding: pypdf is unpinned, so installations may fetch versions with denial-of-service or parsing flaws that were not present during development. For a skill likely to ingest PDFs, this increases operational and security risk from malformed files.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openpyxl
python-docx
pypdf
PyMuPDF
PyYAML

• Confidence: 97% confidence
• Finding: PyMuPDF is unpinned, creating nondeterministic builds and possible exposure to vulnerable releases. Because it is a complex document-processing library, uncontrolled upgrades can materially affect attack surface.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-docx
pypdf
PyMuPDF
PyYAML

• Confidence: 99% confidence
• Finding: PyYAML is unpinned and has a long history of unsafe deserialization issues when used improperly. Allowing the resolver to choose any version materially increases the chance of deploying a vulnerable build, especially if the skill reads YAML from untrusted sources.

Known Vulnerable Dependency: openpyxl — 2 advisory(ies): CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: openpyxl has historical XXE issues in affected versions, and the dependency is unpinned, so the environment could resolve to an unsafe release. In a skill that likely processes spreadsheet files from users, XXE can lead to file disclosure, SSRF, or parser abuse depending on runtime and inputs.

Known Vulnerable Dependency: python-docx — 2 advisory(ies): CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)

High

• Category: Supply Chain
• Confidence: 82% confidence
• Finding: python-docx has known XXE vulnerabilities in older versions, and the package is unpinned, so a vulnerable version could be installed without visibility. Because this library parses DOCX content, attacker-supplied documents could trigger XML entity expansion or external retrieval behavior in affected environments.

Known Vulnerable Dependency: pypdf — 10 advisory(ies): CVE-2026-48156 (pypdf: Possible long runtimes for zero-only width values in cross-reference stre); CVE-2026-24688 (pypdf has possible Infinite Loop when processing outlines/bookmarks); CVE-2026-27628 (pypdf has a possible infinite loop when loading circular /Prev entries in cross-) +7 more

Low

• Category: Supply Chain
• Confidence: 76% confidence
• Finding: The advisory set for pypdf includes multiple denial-of-service style parsing issues, and the dependency is unpinned, so deployment may select an affected version. In document-processing workflows, malformed PDFs can cause excessive CPU usage, hangs, or service instability.

Known Vulnerable Dependency: PyYAML — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: PyYAML has multiple well-known unsafe deserialization and input-validation issues in older versions, and this dependency is unpinned, so an affected version may be installed. If the skill parses YAML from any untrusted or semi-trusted source, exploitation can lead to code execution or serious compromise depending on API usage.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

UI_CONFIRM_RETURN_CODE = 5
DEFAULT_OUTPUT_FORMATS = "docx"
WEBUI_AUTH_TOKEN = ""
WEBUI_REQUIRE_AUTH = False
WEBUI_RUN_ID = f"webui_{uuid.uuid4().hex[:8]}"
WEBUI_LOGGER = setup_logger(__name__, log_dir=(BASE_DIR / "logs"))

• Confidence: 94% confidence
• Finding: `WEBUI_REQUIRE_AUTH = False` establishes a fail-open posture for write operations until later runtime logic changes it. Because the application exposes POST endpoints that start jobs, browse files via AppleScript dialogs, and open directories, an unauthenticated local or mis-exposed network client may be able to drive sensitive actions through the service.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

UI_CONFIRM_RETURN_CODE = 5
DEFAULT_OUTPUT_FORMATS = "docx"
WEBUI_AUTH_TOKEN = ""
WEBUI_REQUIRE_AUTH = False
WEBUI_RUN_ID = f"webui_{uuid.uuid4().hex[:8]}"
WEBUI_LOGGER = setup_logger(__name__, log_dir=(BASE_DIR / "logs"))

• Confidence: 94% confidence
• Finding: `WEBUI_REQUIRE_AUTH = False` establishes a fail-open posture for write operations until later runtime logic changes it. Because the application exposes POST endpoints that start jobs, browse files via AppleScript dialogs, and open directories, an unauthenticated local or mis-exposed network client may be able to drive sensitive actions through the service.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.