self-improving-legal

• Outcome: Pass
• Latest audit: Aug 28, 2026 · 7:19 PM UTC
• Version: 1.1.1

Overview

This is a disclosed legal-learning logger with optional reminders and hooks, but users should keep it project-scoped and avoid logging privileged legal details.

Install only in workspaces where legal learning logs are appropriate. Keep .learnings local or gitignored unless reviewed for privilege and confidentiality, enable only the project-scoped reminder hook by default, and use the Bash output detector, cross-session sharing, cross-skill linking, or extracted skills only after explicit review.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The manifest describes a legal-learning/logging skill, but the document also defines broader behaviors: prompt-triggered reminders, post-tool output scanning, workspace injection, and skill extraction. This mismatch matters because operators may grant the skill trust or install it under the assumption that it only logs legal lessons, while it actually introduces automation and monitoring hooks that expand data exposure and execution surface.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: OpenClaw workspace injection and inter-agent messaging extend the skill from note-taking into persistent prompt-surface modification across sessions. In a legal context, that increases the chance of sensitive matter metadata being propagated more broadly and makes behavior less transparent than the manifest implies.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: Automatic PostToolUse inspection of Bash output is a real security concern because command output may contain secrets, personal data, contract text, or privileged legal material. Even though the file warns not to log raw output, adding an automated scanner still enlarges the observation surface and can normalize passive monitoring of sensitive execution results.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: Automatic skill extraction creates new artifacts from accumulated legal learnings, which risks repackaging sensitive operational knowledge into reusable prompts or files. In the legal domain, even abstracted summaries can leak negotiation patterns, regulatory weaknesses, or litigation-adjacent information if extraction is too permissive.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

### Ownership Rules
- This skill writes only to `.learnings/legal/` in stackable mode.
- It may read other skill folders for cross-linking, but should not rewrite their entries.
- Standalone mode writes to this project's `.learnings/*.md` log files only.
- Stackable mode writes only to the namespaced folder above and must not rewrite other skills' log entries.
- Promotion into `AGENTS.md`, `SOUL.md`, `TOOLS.md`, `MEMORY.md`, rules, hooks, or generated skills is not a logging write. Show a reviewed diff and apply only after explicit user approval.

• Confidence: 81% confidence
• Finding: Permission to read other skill folders for cross-linking is an unnecessary expansion of visibility that can expose configuration, prompts, or sensitive notes from unrelated skills. In a stackable system, cross-skill enumeration increases the blast radius of any prompt-injected or over-permissive skill and can aid unintended information discovery.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.