ClawHub
Back to skill

Security audit

Legal Essentials

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only educational legal checklist for solopreneurs, with no code or system access, but users should treat its U.S.-specific guidance as general information only.

Install only if you want a general solopreneur legal checklist. Do not rely on it for entity formation, tax elections, contracts, privacy compliance, disputes, or regulated industries without checking your jurisdiction and consulting a qualified lawyer.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger list includes the broad term "legal," which is likely to activate in many ordinary conversations and pull in the skill when the user did not request business-legal guidance. Over-triggering is dangerous here because the skill contains prescriptive legal content, increasing the chance of unsolicited or mismatched advice in sensitive contexts.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The skill claims to be educational and not legal advice, but it presents concrete, jurisdiction-specific recommendations and thresholds as broadly applicable guidance. In a legal domain, users may reasonably rely on this content for real decisions, creating risk of harmful reliance, especially where state law, user facts, or non-U.S. jurisdictions differ.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The content is explicitly framed around U.S. legal structures and agencies, but the skill metadata and flow do not require confirming the user's country or state before presenting guidance. Because legal rules vary significantly by jurisdiction, this mismatch can mislead non-U.S. users or even U.S. users in different states into taking incorrect legal steps.